Blog entry - Section 10 - Implementing Information Security

Outsourcing in very simple terms refers to the process of contracting work to a third-party, in this situation information security. The decision by organisations to outsource or fulfill tasks themselves may be depend on certain factors including costs, availability of resources and capital. Depending on the situation it may be beneficial to complete the task ourselves or outsource the task.

Advantages of outsourcing information security may include-
- Improved service
- Improved skiils on tasks/projects
- Improved Return On Investment(ROI)
- Reduced costs
- Shorter implementation cycles
- Business can concentrate on their core business operations

Disadvantages of outsourcing information security may inclyde-
- May risk brand or reputation
- Investments that you may have already made in this area become sunk
- Loss of control to some point
- May not be able to control quality of service

What is a RFP?
Request For Proposal or RFP is an invitation for providers of a product or service to bid on the right to supply that product or service to thwe individual or entity that issued the RFP. As in this situation a request of information security may be made via an RFP, then the organisation can decide how to proceed once they recieved and looked over each RFP.

Evaluation
After recieving RFP's from interested businesses, their proposals need to be evaluated to explore their options of picking one of the proposals and to ensure it is a good option. Before choosing to go into business with another business the business should do thorough investigation and inspection into the prospective business partners history, reputation and products, to ensure a good decision is made.

Contract Award
Is where the business informs the bidding business partner of their acceptance of the submitted bid.

Exit Strategy
There may need to be an agreement between customer and outsourcer, that in the situation the relationship is not working, either party can pull out of the agreement. There may need to be some rules put in place to guide such an event.

"The goal of an information secuity blueprint is to gather an organization's requirements, provide a visualization of those requirements and initiate the process of interweaving information security as part of the organization's culture. The blueprint explains an organization's needs, desired results, factors that could influence the outcome and a strategy to execute",
(http://searchsecurity.techtarget.com/generic/0,295582,sid14_gci1319948,00.html).
An exit strategy may be necessary if outsourcing this above process because the process which has been outsourced is not being fulfilled effectively and is not up to the standard of that business, therefore they may wish to have an exit strategy so they can end that partnership at any time as it may not be beneficial to the business but more of a disadvantage.