What considerations should be made when outsourcing IT infrastructure?

Expert Peter Wood explains how to investigate a partner's security posture when your IT infrastructure is outsourced.

What security considerations should be made when outsourcing IT infrastructure, particularly with the network?
When outsourcing IT infrastructure, the first and most important thing is to ensure the contract requires your outsourcing partner to take security seriously, and will conform to your information security policy and standards (assuming you have them).

If you need an independent set of standards, then ISO/IEC 27002:2005 -- the Code of Practice for Information Security, is a good place to start. The information security guidelines and principles can be used as a checklist to determine the weaknesses in a company's general security posture.

You also need to ensure the contract gives you the right to audit and penetration test the infrastructure, processes and procedures.

If your proposed outsourcing partner is not able to respond proactively when you talk about security and audits, then you may wish to look elsewhere.
This was first published in May 2009



Enjoy the benefits of CW+ membership, learn more and join.

Read more on IT risk management



Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:




  • Dissecting the Hack

    In this excerpt from chapter three of Dissecting the Hack: The V3RB0TEN Network, authors Jayson E. Street, Kristin Sims and Brian...

  • Digital Identity Management

    In this excerpt of Digital Identity Management, authors Maryline Laurent and Samia Bousefrane discuss principles of biometrics ...

  • Becoming a Global Chief Security Executive Officer

    In this excerpt of Becoming a Global Chief Security Executive Officer: A How to Guide for Next Generation Security Leaders, ...