Protecting Outsourced Data

Privacy and security concerns have kept many financial services companies from leveraging low-cost IT service providers in locations like India and China. Executives at Milwaukee-based Northwestern Mutual Life Insurance Co. ($124 billion in assets), however, think they've solved the problem.

For about six months, the diversified insurance and financial services company has been giving offshore IT workers access to applications containing sensitive customer data, including Social Security numbers, through dumb terminals that reside in India but limit the user's ability to alter, record or print the data. "The machines don't even have hard drives," Northwestern Mutual CIO Barbara Piehler says.

The terminals are linked via secure, high-speed telecom lines to Northwestern Mutual's servers in Milwaukee. India-based employees of Infosys Technologies perform testing and maintenance on a number of the company's business applications.

Northwestern Mutual, which has 3 million policyholders, has insisted that Infosys add a number of other security measures to protect customer data. A guard is posted on the floor of the Infosys facility where Northwestern Mutual's work is performed, and employees aren't allowed to take any documents or media off the floor. "No one cares more about protecting our customers than we do," Piehler says.

"Given our stringent security measures, our vendor work is just as secure as any work done in our corporate headquarters," Piehler explains. She adds that the company, which employs about 1,000 technology workers, hasn't cut any domestic IT staff since offshoring IT work to India. Piehler says Northwestern Mutual is considering sending some back-office functions offshore as well.