EPAM believes that the key to manage complex security and compliance issues is automation, implementation of the security policies and practices on the infrastructure level, and building your security infrastructure based on your engagement model. Our security infrastructure is centered on project membership, controlling access to:

• source code repository
• project management system
• flle shares
• distribution lists
• knowledge database
• development and test servers
• physical access to areas

To further ensure segregation of projects, EPAM implements the security on the network level too by constructing and segregating the network to project specific VLANs.

Plus we make sure we aid our physical security with the right level of technology, such as proximity cards, CCTVs, fire and other environment sensors, and making sure all these are in sync with our projects, and customer requirements. EPAM has security setup templates to cover the various needs of our customers, and we are making sure that every time a project gets imitated, we apply the necessary template for aiding it by the infrastructure.

And of course you need to have large enough and powerful enough dedicated staff who audits our compliance to our security policies and procedures, beyond having regular external audits too from ISO27k or from SAS70 stand-point of view.

With outsourcing becoming very popular, has your strategic focus changed from previous years?


Yes it changed, via becoming popular, outsourcing made certain technologies and services a commodity, so to be on the edge and to be able to deliver value added services, we had to move our technology, process and services focus, and address subjects, such as:

• SLA based services
• Agile Processes
• Web 2.0
• Service Oriented Architecture
• Open Source Component Usage/Open Source Licensing issues
• IP Protection
• Security Concerns

What advice would you give to a company interested in outsourcing some of its workload but worried about security compliance laws?

Beyond just following the standard advice of formulating your security requirements and including them in your due-diligence questionnaire and in the contract, go beyond that. Include the possibility of auditing the security regularly at the provider’s premises, request IDS (Intruder Detection System) installation and have the logs of it sent to you regularly, require usage of source code scanning software to detect IP rights infringements and select your outsourcing destination based on your regulatory and compliance requirements, outsourcing to EU and inside NATO for example provides a much higher regulatory and security compliance then to outsource to India for example, this is one of the reasons EPAM follows a geo-diverse growth strategy to be able to serve our clients in jurisdictions/geographies, which best suit their needs.

And before starting the first engagement, go and look for yourself, do the first audit, everything looks perfect on PowerPoint.