R Raghavendra | March 25, 2004

Companies depend on information to operate their business processes. Much of this information is stored and processed electronically, and is exchanged with business partners over computer networks, many of which are public.

The security of this information -- or data -- may be at risk owing to vulnerabilities, with potentially serious consequences to the business of a company or individual.

Data security addresses staff at a business process outsourcing centre who handle the data and put in place systems which guard against careless/criminal agents. It also involves putting in place laws that make it an offence to steal and misuse data.

As BPO involves job losses and has become very emotive, what the people in the US are saying is not so much that the networks extending to India are technically insecure but that 'God knows what those guys do with our tax and social security info; they won't even go to jail if they filch something'.

A key solution is to get the organisation certification for information security management systems or ISMS.

Extensive guidance on organisational aspects of risk assessment and control is given by the British Standards Institution code of practice for ISMS.

The certification is called BS7799-2.2002. It holds the key to mitigating the problem of "identity theft" while offshoring finance and accounts processes even before it arises.

[...]