CSO has an interesting article this morning that shows that even the best written contracts can have some pretty big loopholes:
….. We had negotiated an agreement in which a business would outsource certain key back-office operations to an offshore vendor. The vendor would have possession of the business’ most sensitive trade secret and customer information. As you would expect, the contract included significant detail concerning the information security measures the vendor was expected to maintain. One such measure was the installation of perimeter security cameras at the vendor’s facility. The vendor confirmed all such measures were in place, including the positioning of the security cameras.
As part of post-contract monitoring, a team from the business was dispatched to confirm the vendor had properly implemented the required security measures. Sure enough, when they arrived at the facility, they found the cameras strategically positioned to provide full coverage of the exterior of the facility. The problem, however, was that they discovered the cameras were not actually connected to any monitoring equipment. The wiring terminated at the base of the posts on which the cameras were located. The vendor had installed the required cameras. They just hadn’t connected them to anything.
I wonder how much it cost them to send the team to the “offshore vendor” initially, and how many other problems that came up (or would come up) because the vendor was in another country. To me this is just another example of “penny wise – pound foolish” management.
