March 21, 2006 New York, NY

1. DISCUSSION DOCUMENT Outsourcing Security: Concerns Growing Outsourcing Security Survey Findings March 21, 2006 New York, NY

2. Background on the Booz Allen Hamilton Outsourcing Security Survey • As the use of outsourcing continues to grow, so too do risks to customer and company data that companies must rely on their outsourcing vendors to protect • In order to better understand how companies are managing the information security and data privacy risks of outsourcing, Booz Allen Hamilton surveyed senior executives involved in defining and managing their companies’ outsourcing strategies • The survey, which reflects the responses of 158 executives from companies across a range of industries, June-December 2005, was designed to provide insight into: • Senior Executive perspectives on the magnitude of information security risk involved in outsourcing relationships • How companies approach the evaluation and monitoring of outsourcing vendors’ information security capabilities • The information security and data privacy challenges that the outsourcing industry must address in order to maintain the trust and confidence of customers and clients • The following presentation provides an initial summary of the survey results

3. Key Takeaway: Companies using outsourcing are increasingly concerned about information security • Security is an increasingly important issue among outsourcing buyers • While security is a complex issue, respondents almost unanimously agreed on the need for standards and auditing mechanisms • These mechanisms are particularly needed in some key countries where respondents do not trust the current legal and regulatory infrastructure (e.g. India, China) • Support is growing for government involvement in setting and enforcing security standards • Like financial markets, outsourcing security can benefit from public - private partnerships to provide regulations, standards and audit capabilities • Outsourcing buyers seem willing to pay a premium for improved security capabilities Executive Summary

4. Services, pricing and security capabilities are the top three evaluation factors when selecting an outsourcing partner When selecting an outsourcing partner, what are the most important evaluation factors? Capabilities and quality of services Pricing of service and cost savings to the company Provider's security policies, capabilities and track record Financial strength and business stability Reputation, brand and references Provider's regulatory and compliance history Geographic factors Note: Respondents were asked to select all that apply

5. Companies are more concerned about cyber threats than physical breaches and natural disasters When evaluating or managing outsourcing relationships, how concerned are you about the following type(s) of security threats? Theft, misuse or damage of company systems and data from outside the Outsource Provider (system hacking, viruses, spyware infiltration, etc.) Cyber Threats Theft, misuse or damage of company systems or data from inside the Outsource Provider Theft or damage of data or assets via compromises of physical security (break-ins, vandalism, etc.) Non-cyber Threats Compromise of operating continuity due to external factors (natural disasters, political instability, etc.) Note: Includes only # of respondents who answered “Very Important” in each category Note: Respondents were asked to select all that apply

6. Increased awareness of security risks has led many companies to review their outsourcing strategies in the last year As a result of this knowledge, has your company reviewed its overall outsourcing strategy in the last year? In the last two years, have you heard of specific examples of outsourcing security failures and/or breaches of privacy? No Yes 37% No Yes 42% 58% 63%

7. The security risk is perceived as significantly higher for providers with offshore operations Do you perceive a greater or lesser risk of security threats for outsourcing providers located offshore? No basis for comparison Much Lower 1% 4% Moderately Lower 2% Same 28% 17% Much Higher 76% of respondents consider the security risks when using offshore providers higher than the risks associated with domestic providers 48% Moderately Higher

8. North America is seen as having the most robust legal and regulatory environment, followed by Ireland and the emerging EU countries of eastern Europe India is seen as fair, with room to improve, as only 27% of respondents indicated that the area has a robust legal infrastructure China, South America, and Southeast Asia were seen has having the biggest legal and regulatory gap, with 11 percent or fewer respondents indicating they had a robust infrastructure Providers with operations in India, Asia and South America are particularly challenged by a legal and regulatory perception gap Which geographies have a robust regulatory and legal infrastructure? Major Findings Challenging Regulatory and Legal Environments % of Respondents selecting geography Note: Respondents were asked to check all that apply

9. Providers’ security capabilities matter more than providers’ security budgets …. How important are the following security factors when evaluating and managing an outsourcing relationship? Provider’s network & system security Provider’s compliance with standards and laws Verifiable security management capabilities matter more than absolute spending Provider’s personnel security policy and procedures Physical security at provider’s facilities Provider’s security team (depth of expertise) Provider’s security budget (provider’s budget on security relative to industry best practices) Note: Includes only # of respondents who answered “Very Important” in each category Note: Respondents were asked to select all that apply

10. …however defining, monitoring, and integrating security management in outsourcing contracts is a growing challenge Which factors present the biggest management challenges in evaluating and managing security in outsourcing relationships? Establish effective security management requirements in the contracts Monitoring, auditing and evaluating vendor compliance with established security policy Evaluating and implement security technology and process integration Acquiring and maintaining the right skill sets and capabilities to manage security Determining how much to invest in security in an outsourcing relationship Delivering effective training in policies and procedures of Outsourcing Providers % of respondents putting factor in top 3

11. Companies want more 3rd party audits and independent security evaluations of outsourcing providers What tools do you feel are most important to use in evaluating the security capabilities of outsourcing vendors? Site visits and in-person audits of vendor security processes and capabilities Pull metrics References from other clients 3rd party security certifications (e.g., NASSCOM) Security industry benchmarks & analyst reports Vendor’s security track record as reported in media, industry press Push metrics Vendor’s self-reported metrics (e.g., RFP responses) Information on vendors sought by companies (pull metrics) is more reliable than vendor-reported metrics in RFPs or media (push metrics) Note: Respondents were asked to select all that apply

12. The US government could play an increasing role in creating security and privacy regulations for outsourcing providers Should the U.S. create specific regulations for outsourcing providers to ensure they meet commonly accepted security and privacy standards? Yes, across all providers, functions and service categories No 33% 32% Two thirds of respondents are open to some form of US regulation of security standards 34% Yes, but only for specific functions or service categories

13. Outsourcers should work with associations and governments to define and establish security regulations and standards… Who should be responsible for defining and establishing the standards? Customer trade groups or industry associations Industry associations top preference for establishing security standards Outsourcing service provider coalitions or industry associations Independent experts and outside consultants Government-led from within major industrialized nations (e.g. U.S., Europe) Government-led from countries with growing outsourcing industries (e.g. India, China) Industry ready for public-private partnerships for setting standards and regulations # of Respondents expressing preference

14. …while leveraging external auditors for monitoring Who should be responsible for certifying, monitoring and enforcing standards? External enforcement via regular certifications and audits by external consultants and auditors Self-enforcement and reporting at the outsourcing company level Nearly 2:1 preference for 3rd party audits over self-enforcement External enforcement via active regulation and management by government entities # of Respondents expressing preference

15. Investments should be prioritized for security training and awareness, new technologies and improved policies/procedures How do you believe outsourcing providers should prioritize their security investments? Invest in internal security training, education and awareness initiatives Invest in new security technologies Improve published security policies and procedures Invest in outside, independent assessments to highlight internal security and compliance track record Invest in new physical security and other business continuity initiatives # of Respondents expressing preference Note: Respondents were asked to check all that apply

16. Buyers may be willing to pay a premium for improved security capabilities — challenging the industry to demonstrate ROI Would you be willing to pay 10% to 15% more for outsourcing services if you thought it would ensure superior security? No - additional security is either not worth the premium or it is too difficult to validate Definitely - proven security is worth the additional cost 15% 30% 85% of respondents may be willing to pay some premium for improved security 55% Maybe - would depend on comparison of security against other factors

17. Other Supporting Findings

18. Respondents viewed service disruption, loss of customer trust and brand impact, and loss of intellectual property as equally important outsourcing security risks What do you believe are the greatest security risks and vulnerabilities to your business from outsourcing? Disruptions in product delivery or service caused by breakdowns in mission critical business processes or functions Loss of customer trust or relationships due to improper or fraudulent use of confidential customer data Loss of intellectual property or other sensitive information via either accidental exposure, theft or misuse of corporate data Brand or reputation damage that results in loss of goodwill arising from actual or perceived risk of security failures Risk that your company is liable for improper actions of your outsourcing provider Other # of Respondents expressing preference Note: Respondents were asked to select all that apply

19. Companies are more concerned about theft or misuse of outsourced data than they are about the threat of terrorism From your perspective, how serious is the threat of terrorism for the operations of domestic outsourcing vendors? How concerned are you about theft, misuse or damage of company systems and data from outside/inside an outsource provider? Serious Threat Not Concerned No Basis for Evaluation 9% 9% 15% Moderate Threat Somewhat Concerned 28% 39% 63% 47% Very Concerned Low Threat Less than 50% view terrorism as a moderate – serious threat, while 91% were somewhat – very concerned about data theft or misuse

20. There is credibility gap in the security capabilities of providers, with clients in some verticals more skeptical than others 15% • Less than half of financial services respondents trusted even the largest providers’ security capabilities 25% 25% For your industry, do you find the security capability claims of outsourcing providers credible? Financial Services 30% 30% Yes Maybe, but no way to verify or validate claims 14% 18% 30% • Government respondents were even more skeptical with less than 30% trusting all or the largest providers 36% 25% 9% Government 36% 37% 20% Yes, but onlythe largest No 14% 24% • 67% of manufacturing respondents found some degree of provider security claims to be credible 25% Half of respondents discredit outsourcers’ security claims Verification of compliance 2nd most important evaluation factor 19% Manufacturing 43%

21. For your industry, what do you expect in the outsourcing market in the next two years? Reduction in the size of the market Slowing growth or market stagnation 6% 7% 49% 38% Continued growth and successful expansion of outsourced functions (e.g., moving upstream into R&D) Continued growth, but with little expansion beyond current functions Over the next two years, respondents expect continued growth in the outsourcing market, but are generally divided on whether growth will occur in existing functions, or expand upstream 5% • 95% of financial services respondents expect outsourcing market growth to continue, but are divided on expansion into upstream functions Financial Services 50% 45% • Government respondents are less certain, with almost 40% expecting market stagnation or reduction 27% 36% Government 9% 27% 5% • 86% of manufacturing respondents expect outsourcing market growth to continue, but are divided on expansion into upstream functions 10% Manufacturing 43% 43%

22. Survey Methodology and Demographics

23. Survey Methodology • Respondent Selection Method: Invitations to participate in the study were distributed via email to a select group of contacts: • Booz Allen current and former clients • Other comparable senior executives gathered through selective acquisition • Registered opt-in subscribers to email lists for knowledge@wharton and strategy+business magazine • Participants in Outsourcing Seminar as part of Conference Board’s 2005 BPO Conference • Format: Online survey hosted by Booz Allen Hamilton • Date of Survey: June – December 2005 • Number of Respondents: 158

24. 83% of respondents are currently outsourcing or actively considering doing so Is your company either currently outsourcing any functions or actively considering outsourcing? 17% NO 83% YES

25. Over half of survey respondents were senior executives Responses by Function CXO* Other 32% 53% 15% Procurement / Regulatory Officer *CXO category includes Chairman, President, CEO, CFO, Controller, COO, CIO, CTO, CISO, VP Operations

26. The 158 respondents to the survey represented 12 different industry sectors Distribution by Industry

27. Survey respondents represented companies of all sizes Distribution by # Employees Distribution by Revenue

28. For more information regarding this survey, please contact: • Vinay Couto, Vice President, Chicago • (312) 578-4617 • couto_vinay@bah.com • Jim Newfrock, Principal, Parsippany, NJ • (973) 630-6789 • newfrock_jim@bah.com • Jon Watts, Principal, New York, NY • (212) 551-6644 • watts_jon@bah.com • Martha-Rosalind Stainton, Senior Associate, McLean, VA • (703) 902-3815 • stainton_mr@bah.com