Information security considerations in IS/IT outsourcing projects: a descriptive case study of two sectors

This paper presents an overview of a national case study exploring the information security considerations in the Information Systems/Information Technology (IS/IT) outsourcing projects in the public and private sectors of Kuwait where the data collection for this study was carried out. The primary data on IS/IT outsourcing practices, obtained for the first time in Kuwait, were collected by means of survey questionnaires and semi-structured interviews supported by organisational documentation. Several public and private sector organisations were selected to participate in the investigation. This study is descriptive in nature. Its main findings suggest that security concerns have been the most prominent risk factors and have overtaken the other risk issues (e.g. loss of control, hidden costs) which were thought to be the most serious in dealing with IS/IT outsourcing in the Kuwaiti environment. The causes of such concerns are also addressed. The findings also provide an insight into how outsourcing practices, as an information system strategy, are managed in the context of Kuwait.

[1]  Allen S. Lee.  A Scientific Methodology for MIS Case Studies , 1989, MIS Q..

[2]  R. Yin.  Yin, Robert K., Case Study Research: Design and Methods, 2nd ed. Newbury Park, CA: Sage, 1994. , 1994 .

[3]  Bruce Rocheleau,et al.  Public management information systems , 2005 .

[4]  KaplanBonnie,et al.  Combining qualitative and quantitative methods in information systems research , 1988 .

[5]  Leon A. de Looff,et al.  Information systems outsourcing decision making: a framework organizational theories and case studies , 1995, J. Inf. Technol..

[6]  John Hendry,et al.  Culture, community and networks: The hidden cost of outsourcing , 1995 .

[7]  John Sherwood,et al.  Managing security for outsourcing contracts , 1997, Comput. Secur..

[8]  Stuart Bretschneider,et al.  Management Information Systems in Public and Private Organizations: An Empirical Test. , 1990 .

[9]  James L. Perry,et al.  The Public-Private Distinction in Organization Theory: A Critique and Research Strategy , 1988 .

[10]  Geoff Walsham,et al.  Interpretive case studies in IS research: nature and method , 1995 .

[11]  Rudy Hirschheim,et al.  REALIZING OUTSOURCING EXPECTATIONS Incredible Expectations, Credible Outcomes , 1994 .

[12]  Detmar W. Straub,et al.  Validating Instruments in MIS Research , 1989, MIS Q..

[13]  Prashant Palvia,et al.  Global information technology environment: key MIS issues in advanced and less-developed nations , 1992 .

[14]  Jae-Nam Lee,et al.  Information systems outsourcing strategies for affiliated firms of the Korean conglomerate groups , 1997, J. Strateg. Inf. Syst..

[15]  Bonnie Kaplan,et al.  Combining Qualitative and Quantitative Methods in Information Systems Research: A Case Study , 1988, MIS Q..

[16]  Harold F. Tipton,et al.  Information Security Management , 2000 .

[17]  Joel Gerston,et al.  Outsourcing in Client/Server Environments , 1997, Inf. Syst. Manag..

[18]  M. A. Badri,et al.  Critical issues in information systems management: An international perspective , 1992 .

[19]  Uma G. Gupta,et al.  OUTSOURCING THE IS FUNCTION , 1992 .

[20]  R. Hirschheim,et al.  Beyond The Information Systems Outsourcing Bandwagon: The Insourcing Response , 1995 .

[21]  Robert Millen,et al.  Information Systems Outsourcing by Large American Industrial Firms: Choices and Impacts , 1995 .

[22]  Soon Ang,et al.  Employment outsourcing in information systems , 1996, CACM.

[23]  H. Rainey,et al.  Public Agencies and Private Firms , 1983 .

[24]  Patrick Y. K. Chau,et al.  A study of information technology adoption in Hong Kong , 1995, J. Inf. Sci..

[25]  CollinsJ. Stephanie,et al.  Information Systems Outsourcing by Large American Industrial Firms , 1995 .

[26]  Angèle L. M. Cavaye,et al.  Case study research: a multi‐faceted research approach for IS , 1996, Inf. Syst. J..

[27]  W. Currie.  Outsourcing in the private and public sectors: an unpredictable IT strategy , 1996 .

[28]  Guy G. Gable,et al.  Integrating case study and survey research methods: an example in information systems , 1994 .

[29]  R. Hirschheim,et al.  Information systems outsourcing : myths, metaphors, and realities , 1993 .

[30]  Izak Benbasat,et al.  The Case Research Strategy in Studies of Information Systems , 1987, MIS Q..

[31]  A. D. Jankowicz.  Business research projects , 1995 .

[32]  M. L. Gordon,et al.  Outsourcing technology in government: Owned, controlled, or regulated institutions , 1997 .

[33]  Robert B. Adams,et al.  EIS: It Can Work in the Public Sector , 1990, MIS Q..

[34]  BretschneiderStuart,et al.  Organizational Adoption of Microcomputer Technology , 1993 .

[35]  L. Willcocks,et al.  Contracting Out Information Technology in Public Sector Contexts: Research and Critique , 1997 .

[36]  Barry Bozeman,et al.  Public management information systems: theory and prescription , 1986 .

[37]  Lawrence Loh,et al.  Diffusion of Information Technology Outsourcing: Influence Sources and the Kodak Effect , 1992, Inf. Syst. Res..

[38]  Anthony DiRomualdo,et al.  Strategic Intent for IT Outsourcing , 1998 .

[39]  Dieter Fink.  A Security Framework for Information Systems Outsourcing , 1994, Inf. Manag. Comput. Secur..

[40]  M. Buck-Lew,et al.  To outsource or not , 1992 .

[41]  E. Guba.  Criteria for assessing the trustworthiness of naturalistic inquiries , 1981 .

[42]  K. Eisenhardt.  Building theories from case study research , 1989, STUDI ORGANIZZATIVI.

[43]  J. Barthélemy.  The Hidden Costs of IT Outsourcing , 2001 .

[44]  R. Nolan,et al.  How to Manage an IT Outsourcing Alliance , 1995 .

[45]  Stuart Bretschneider,et al.  Organizational Adoption of Microcomputer Technology: The Role of Sector , 1993, Inf. Syst. Res..