The result is the loss of an organization s direct control over it s most critical information, to be replaced by a sharing of less direct and more uncertain information protection responsibilities with another organization. Since the information which is being shared is often highly sensitive, the usual legal clauses regarding errors and omissions are insufficient. More specific and serious information security requirements are appropriate, such as a preventive security clause in the contract which states that any other organization receiving sensitive proprietary information must show how it will meet specifically stated security provisions. As a further security measure, a clause should be added to the contract indicating that such organizations will be subject to unannounced security reviews and audits in order to ensure that those information security provisions are being met. Unacceptable information security findings will serve as grounds for an immediate contract violation and the swift suspension of that particular outsourcing relationship.
Strategic alliances are another business decision which have information security consequences.
These alliances are extensions of an organization's services and information outward to partners and customers. Often, these extensions can blur who owns and who should protect information, skills, technologies, and other transferable properties. In many alliance situations, sensitive information is being shared with others and one organization s control structure and rules of protection, as strong as they can be within the boundaries of the enterprise, may not be carried over into the new inter-company relationship. The result may be a information technology- driven blurring of corporate boundaries between the alliance members. Project teams independent of geographical and even organizational relationships may end up sharing information through groupware programs, creating information which is owned by everyone and secured by no one.