26) Securities and Risks of Offshore Outsourcing.

The fact that IT infrastructure is now global makes the security of offshore IT operations more necessary. This is especially true in India. Many companies assume that as long as the necessary homework is done, the offshore risk can be avoided. However, the distance as well as different government laws can bring more risk. Otherwise, the security risks offshore generally aren't any different from the security risks you may face onshore.

Offshore software outsourcing service providers must make sure of the safety of an offshore IT infrastructure. One of the most famous countries for offshore software outsourcing is India. India is recording a double-digit increase in revenues from IT services. On the grounds of a U.S. model, India is to spend 5% to 7% of the IT budget on security, and with the IT budget consuming 15% of a service company's revenue, they should spend up to $450 to $600 million on offshore software information security and assurance by the year 2008.

Guiding principles to Minimize Risk and Secure Offshore Operations:

1) Before you start any offshore operation, you should know your security and privacy requirements.
2) In addition to a thorough understanding of your security needs, you should have a clear idea of the host country's legal climate.
3) Before signing any agreements that include regulatory compliance, do a complete security assessment.
4) List all specific offshore requirements and write them into your SLA (service-level agreement) for vulnerability assessments, tests, and audits.

The steps to take:

First: securing the move (and subsequent offshore operations) is a detailed, four-step planning process to clarify what is done onshore and offshore.

Second: pay attention to IT portfolio evaluation to identify processes and operations suitable for moving offshore.

Third: manage to acquire the hardware, software and other resources needed for the offshore operation (from both your company and the offshore service supplier).

Finally: you should not neglect the actual operational management, including the offshore program supervision.