Insufficiently established or inappropriately implemented information security management on the part of an outsourcing service provider entails significant risks. It is problematic, for example, if no one takes overall responsibility for the topic of information security, the provider's executives do not sufficiently support the topic, the strategic and conceptual guidelines are inadequate, or the security process is not transparent. If the outsourcing service provider's overall approach to information security is poorly organised, it runs the risk of not being able to meet the requirements of outsourcing organisations.