Within the framework of an outsourcing project, large amounts of information are typically transmitted between the customer and the outsourcing service provider. Depending on the protection needs of the information to be processed, insufficient rules on information security may result in security issues. The spectrum of inadequate rules ranges from unclear responsibilities and control functions to guidelines that are incomprehensible, incoherently formulated, or simply not in place.