If an organisation decides to outsource part of its operations, it makes itself dependent on its outsourcing service provider. This dependency entails the risk that knowledge may be lost and the outsourced processes and components can no longer be fully controlled. In addition, the protection needs of outsourced business processes and information could be assessed differently. This can lead to the implementation of security safeguards that are inappropriate for the protection needs at hand. Outsourcing customers often entrust entire business processes to outsourcing service providers. An outsourcing service provider can thereby gain complete control of business processes involving sensitive information, resources and IT systems. At the same time, the outsourcing customer's knowledge of these areas decreases. As a consequence, it is possible that the outsourcing customer will no longer notice deficits in information security. This situation could be exploited by the outsourcing service provider in the form of drastically increased prices or a lower quality of service.