Security for Information Technology Service Contracts
• SEI Report
Publisher
Software Engineering Institute
CMU/SEI Report Number
CMU/SEI-98-SIM-003Abstract
This 1998 document is one of a new series of publications of the Software Engineering Institute at Carnegie Mellon University- security improvement modules. They are intended to provide concrete, practical guidance that will help organizations improve the security of their networked computer systems.
An increasing number of organizations are contracting with outside companies for the installation and maintenance of their information technology (IT). All too often, these organizations experience increased difficulty in providing appropriate oversight of the services and software for which they have contracted. For example, contractor access to the organization's systems is often neither well-controlled nor secure, placing information systems and data at risk. The practices recommended in this document are designed to assist your organization in managing the contractor, managing the contract, and deterring common, known security problems when IT services and software are externally contracted.
Cite This SEI Report
Allen, J., Ford, G., Fraser, B., Kochmar, J., Konda, S., Simmel, D., & Cunningham, L. (1998, January 29). Security for Information Technology Service Contracts. (SEI Report CMU/SEI-98-SIM-003). Retrieved August 18, 2026, from https://www.sei.cmu.edu/library/security-for-information-technology-service-contracts/.
@techreport{allen_1998,
author={Allen, Julia and Ford, Gary and Fraser, Barbara and Kochmar, John and Konda, Suresh and Simmel, Derek and Cunningham, Lisa},
title={Security for Information Technology Service Contracts},
month={Jan},
year={1998},
number={{CMU/SEI-98-SIM-003},
institution={Software Engineering Institute, Carnegie Mellon University},
url={https://www.sei.cmu.edu/library/security-for-information-technology-service-contracts/},
note={Accessed: 2026-Aug-18}
}
Allen, Julia, Gary Ford, Barbara Fraser, John Kochmar, Suresh Konda, Derek Simmel, and Lisa Cunningham. "Security for Information Technology Service Contracts." (CMU/SEI-98-SIM-003). Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, January 29, 1998. https://www.sei.cmu.edu/library/security-for-information-technology-service-contracts/.
J. Allen, G. Ford, B. Fraser, J. Kochmar, S. Konda, D. Simmel, and L. Cunningham, "Security for Information Technology Service Contracts," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, SEI Report CMU/SEI-98-SIM-003, 29-Jan-1998 [Online]. Available: https://www.sei.cmu.edu/library/security-for-information-technology-service-contracts/. [Accessed: 18-Aug-2026].
Allen, Julia, Gary Ford, Barbara Fraser, John Kochmar, Suresh Konda, Derek Simmel, and Lisa Cunningham. "Security for Information Technology Service Contracts." (SEI Report CMU/SEI-98-SIM-003). Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 29 Jan. 1998. https://www.sei.cmu.edu/library/security-for-information-technology-service-contracts/. Accessed 18 Aug. 2026.
Allen, Julia; Ford, Gary; Fraser, Barbara; Kochmar, John; Konda, Suresh; Simmel, Derek; & Cunningham, Lisa. Security for Information Technology Service Contracts. CMU/SEI-98-SIM-003. Software Engineering Institute. 1998. https://www.sei.cmu.edu/library/security-for-information-technology-service-contracts/