IT Security Still a Concern on Outsourcing
November 28, 2009 – 6:23 pmThe YouGov survey commissioned by IT assurance specialist NCC Group showed that 20% of IT managers working in large businesses believe that their outsourced systems and processes have less IT security than those based in-house, showing lack of confidence in the IT security of outsourcing providers.
Currently, 89 per cent of large companiesoutsource at least one IT system or business process.
John Redeyoff, Head of 365 Assured at NCC Group said: “The security industry and IT managers are calling for suppliers to prove they are secure, yet companies choosing to outsource business critical systems simply aren’t asking the right questions, and are putting business critical functions at risk as a result. Businesses that fail to check their suppliers’ credentials, choosing cost and convenience over security, are investing in false economy.
“Suppliers, particularly to highly regulated industries such as banking or the public sector, need to demonstrate their commitment to security, giving reassurance to existing or potential customers that they take these issues seriously. As fast as technology develops, so does the potential for data compromises, and businesses need to be prepared to answer serious questions about their IT systems. Proving you are secure is simply good business.”
Almost a quarter of IT managers (22 percent) at large companies have the same low expectation of their suppliers. A third of IT managers (64 percent) at medium sized businesses expect some of their suppliers not to have formal security procedures in place.
According to NCC Group, this suggests that despite IT managers’ concerns that their suppliers are not secure, companies are opting for low-cost providers that cannot prove their security credentials.
John Redeyoff, head of 365, a new security and performance certification program from NCC Group said, “The security industry and IT managers are calling for suppliers to prove they are secure, yet companies choosing to outsource business critical systems simply aren’t asking the right questions, and are putting business critical functions at risk as a result. “
