Security Think Tank: Business cannot outsource accountability


Security Think Tank: Business cannot outsource accountability

You can in theory outsource anything except accountability and crisis management. It’s all down to risk appetite, assuming of course that your outsourcer meets compliance requirements.

Security is all about visibility and control. You lose both when you outsource, but independent contractors can be used to check on other outsourced activities.


The paradigm for trust is also changing for the information age. The old regime is neatly summed up by the old Russian quote, “Trust is good, but control is better” (equally ascribed to both Stalin and Lenin).

The new philosophy is encapsulated by Ronald Reagan’s famous quote, “Trust but verify”.

David Lacey is the UK research director for the Information Systems Security Association (ISSA)

Read more about IT security outsourcing

Security Think Tank: Start with capability gap when outsourcing security

Security Think Tank: Outsourcing of IT security is not for everyone

Security Think Tank: No one-size-fits-all approach to security outsourcing




Email Alerts

Register now to receive IT-related news, guides and more, delivered to your inbox.
By submitting your personal information, you agree to receive emails regarding relevant products and special offers from TechTarget and its partners. You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.

This was first published in May 2012


COMMENTS powered by Disqus  //  Commenting policy