¿Cómo se protegen los servicios de TI subcontratados?

To ensure robust protection, I begin by thoroughly evaluating potential service providers' track records and security protocols. Contracts are meticulously crafted to include stringent security clauses and compliance requirements. Ongoing monitoring and regular audits guarantee adherence to established standards. Implementing access controls, encryption, and multi-factor authentication fortify our defenses. Collaboration and open communication foster a strong security partnership. Periodic cybersecurity training ensures both teams stay vigilant. Continuously reviewing and upgrading security practices is vital to stay ahead of emerging threats. A proactive and comprehensive approach ensures the safety of our outsourced IT services.

These are great first steps, but any 3rd party will create their own layers of additional risk. The reason for outsourcing any service should help reduce risk and bring it down to an acceptable level. Conducting assessments around at least three vendors helps define the strengths and weaknesses of each and further refining the key priorities for selection. Using reference interviews from clients of the provider can further validate or weed out a provider.

How do you secure outsourced IT services? It’s by managing the risk that the outsourced company owns. Mitigation is the way you secure your organizational risk. Suitable risk mitigation strategies are crucial to success when services are outsourced. Most organizations look at mitigating the risk after signing a deal, only to realize the cost of those risk mitigation strategies ends up eating away any of the savings or perceived benefits. Mitigation of risks comes at a price, and deals can be structured where the vendor manages those risks and, if not possible, can be part of the business case in deciding if outsourcing that particular service is worth it.

I personally believe these are the factors that are just at a very high level. I also feel 3V policy or Three Vendor policy is just another way for bypassing the compliance and to showcase that there are no actual risks. I have been part of such negotiations with clients and I have seen the procurement teams being bribed to get those contracts. So along with the above risks that are considered, I suggest they should put up automation (systems or bots) where the requirements are specified and any and all possible vendors could submit their proposals, and then let the best one win and take the contract. The legal compliances and criteria should also be part of the same automation/system.

If you outsource a mess, be prepared to pay the price. Get your house in order... know what you want. Write clear and concise agreements. Ambiguity usually means you will pay more, suffer breaches. Make sure the outsourcer has a fiduciary responsibility in the event of a breach of services they provide. Do some sort of threat risk assessment and base your decisions upon those findings. Being cheap on security will come back to haunt you. A simple thing like not keeping patches up to date will vastly increase your risk - all patches - OS, firmware, network devices. As part of any outsourced security service, it should be checked/validated on at least an annual basis - by a different organization.

Bad things can certainly happen if you foray into outsourcing lightly. Doing vendor due-diligence and understanding how your vendors secure your data (and potentially customer or investor data) is also critical. A friend recently built an ecommerce app and outsourced the integration of the payment processing. The provider that was handling the project allowed the company's Stripe API keys to be stolen and her business ended up with thousands of fraudulent transactions. Stripe ultimately held her company accountable for hundreds of thousands of dollars in refunds, plus all the penalties and transaction fees associated with the refunds. It has nearly put them out of business, and she's been forced into investigating bankruptcy protections.

In order to choose the right IT service provider for your business, you have to rely on 2 things. Third party advisors in your country / market segment who knows the vendors and their strengths and you do your own due diligence in the form of reference calls. You should have atleast 2 or 3 reference calls / meetings with the vendor's current customers ( one from the same country as you are in, one from the industry / segment your business in and finally one customer who has similar / same scope as you).

Honesty plays a critical role in choosing the right IT vendors, some may have policies and systems in place but their personnel have no integrity.

It is only when they go wrong that machines remind you how powerful they are..................................................

In my experience: References and reputation 💬🥇 Tries to garantee success based on previus experiences of providers. A powerpoint or multimedia presentation can show miracles, but references from other professionals could save you from future problems

The clarity in the contract is important to protect both parties' interests and maintain a good relationship in the long run.

A RACI matrix is a great visual way of demonstrating roles and responsibilities, including this into a contract is an easy way of confirming between both entities and remove any possible confusion. The right to audit should also be included into the contract if the vendor will be handling any sensitive or private data.

SLAs should be used. Clear and concise KPIs must be used to hold vendors accountable. Penalties should also be included, but should be reasonable.

The contract is your ultimate safeguard when outsourcing IT services. As a CEO, I review all outsourcing contracts personally. We had an issue with an IT support vendor refusing to take responsibility for a critical failure that impacted clients. Thankfully, our detailed contract clarified liability, allowing us to hold the vendor accountable. We were able to claim damages successfully. All our IT outsourcing services or managed IT services come with a list of roles and responsibilities, signed NDA, code ownership and other such responsibilities we presume towards our clients’ data and security.

Some of the challenges experienced once the service is onboarded is that often during the transition, the team that are supporting the service are unsure of what to do, which stems from the fact that the teams negotiating and putting up the contract were also either unclear or skimmed over stuff. A detailed breakdown of services and clear concise understanding from both parties is required. Measures in place have to be relevant. Often services tend to be copy paste and no one ever provides new measures that is innovative from the norm so effectively one ends up swapping to a new provider with the previously setup measures, just a bit more stringent in which case, what is the point?

Need to follow up with provider closely to ensure they are dispatching resources in proper SLA deadlines according to the priority of the ticket.

It requires a significant investment in time and resources but ensure that your staff is aware of the risks associated with outsourcing and how to protect your data. They should also know how to identify and report any suspicious activity.

Debrief with a service form is done on the spot to explain the tasks carried out by the engineer. Feedback is collected for further adjustments for improvement.

There should be accountability and detailed documentation on who has access to what and any credentials provided to all third parties, how they access systems, and if possible configure and enforce access reviews

Staying on top of vendor performance through monitoring and governance is key, despite their credentials. We encourage our clients to conduct regular reviews, track KPIs and conduct spot checks on our remote talents and any other partners they’re associated with. This helps pre-empt major issues. We also collaborate closely rather than work in silos.

If IT is not your core business or product but your company needs reliable technology without hiring a high-salaried professional, outsourcing might be the way to go. However, you should scale the service to the size of your organization with a view of future growth. The best and latest may not be necessary but something that is safe, secure and simple. IT companies should all definitely check certain key boxes: - reliability - responsiveness - security/confidentiality - and efficiency P.S. The cheapest may not be your best option.

My approach is to actively involve internal teams when outsourcing IT services. We provide training on technologies, security protocols and engagement models. This equips staff with the knowledge to participate in the initiatives and maximize outcomes.

Soft skills are often overlooked, but they are one of the most crucial elements in successful cooperation with IT vendors. 🍀 Here's why: 1️⃣Communication: Clear and concise dialogue ensures that both parties understand expectations and responsibilities. 2️⃣Empathy: Understanding the vendor's perspective helps in building a relationship that goes beyond mere transactions. 3️⃣Adaptability: The IT world changes rapidly. Being flexible helps in adjusting to new technologies and market demands. In essence, soft skills create a bridge between technical know-how and human interaction. In the complex landscape of IT vendor relationships, these skills are not just beneficial; they are essential.

Training for customer staff will be provided as they can act as a first responder to any incidents that happen on the ground and remedy it if possible.

Staff training is essential to ensure adept management of outsourced IT services. Equip your team with insights into the advantages and potential pitfalls of outsourcing, familiarity with contractual terms, awareness of provider security protocols, and adeptness in data protection practices. Empower them to recognize and report anomalies, and furnish the tools and resources for seamless collaboration with the provider.

I can think of some of these key points that an organization should consider while making a plan for outsourcing its IT Service to a vendor. Vendor selection. Access Management & IAM Policies. Data Encryption at the source. Security Audit. Incident Management. Change Management. Data Protection & Disaster Recovery. Secure communication channels. Vendor's Employee Training & Assessment. Compliance and Legal Considerations. Continuous evaluation. Again, the standard practices might differ from one organization to the other but they will mostly overall remain the same.

Eventually it will get costly, and you will have to bring it back in house to keep cost down and gain total control because outsourced IT will never be as focused and be aware of your internal nuances like internal IT who are not distracted by many clients, many issues. I have seen it happen more than twice.

One more important factor to consider is that the service provider should be considered as an extended team of the company. Not as a separate entity. This helps to avoid conflicts in accountability and also all members have a sense of the responsibility.

I think it has been said previously but in order to have a true partnership with a provider you need to have a strong relationship with them. There will often be conflicts over the term of a contract and knowing the team that you are reliant on will help when the going gets tough. Also, I have often said that if I have to go look at a contract to get my vendor to do something or hold them accountable for something that they did not do then I need to find a new vendor.

Fastfood outlets are convenient, useful and economic in times but only a lazy fool will close down own kitchen and opt outsourcing as a permanent replacement.