State of the art of IT outsourcing and future needs for managing its security risks

It is very common for different organizations around the globe to outsource their IT services partially or totally using a third party. IT Outsourcing is a promising business practice that could offer organizations different benefits such as cost reductions, concentration on core business activities, flexibility and quality improvement. Despite the enormous benefits that can be offered to organizations by outsourcing, it might expose organizations to different risks such as security risks and contract violations. In this paper, we explore the outsourcing business practice, its benefits, risks, and all other processes and arrangements associated with it. We provide several recommendations for managing the security risks of IT outsourcing effectively, such as aligning security management with project management, establishing a comprehensive methodology for managing security requirements, managing security risks from different perspectives, managing compliance, and improving flexibility and usability. We also provide a general framework for security risks management in outsourcing context.