Information security risk management: An empirical study on the importance and practices in ICT outsourcing

There are many organizations opt for outsourcing in order to cut cost and improve efficiency for their ICT services. On the other hand, ICT outsourcing could also contribute to some risks especially information risks that could jeopardize information asset in the company. An appropriate information security risk management (ISRM) in ICT outsourcing should be in place in order to minimize the potential risks and their impact to business operation as well as ICT services. The objective of this research is to conduct an empirical study on the relationship between importance and practices of ISRM in ICT Outsourcing. Questionnaires were distributed to various private companies and government agencies in Malaysia for the study. Findings of the study show that importance of ISRM process influences its practices in ICT outsourcing. Through the findings, information security risk professional would be able to identify the importance of ISRM and improve their practices in managing information security risk for ICT outsourcing projects. Finally, companies and government agencies need to improve their practices managing information risks in ICT Outsourcing.