Multilateral Contracts in Information Security Outsourcing

Abstract

Coordinating the efforts of contractual parties in information security outsourcing is challenging given that a managed security service provider (MSSP) and its contractual partners cannot perfectly observe or verify each other's investment. This study examines the use of multilateral contracts in addressing the double moral hazard problem for managed security services. We present a comprehensive investigation of multilateral contracts, and analyze the influence of externalities and breach probabilities on contingent payments. The results show that a normalized externality, the ratio between a firm's externality and its investment efficiency, dictates the levels of contingent payments in multilateral contracts. We further demonstrate the flexibility of designing multilateral contracts, and discuss three contract types: the equal-refund contract, the externality contract, and the risk-free contract. Each contract type brings different benefits to the contractual parties and can be chosen based on their security management preferences. At last, we show how to extend these contract types when the number of firms increases.