Selective sharing

When working with “outsiders”—consultants and other outsourcers—executives and project leaders must wrestle with some big ideas: intellectual property, proprietary data, trade secrets, personnel files, financials and other types of information. No one knows the precise dollar value of information potentially at risk when information is shared between firms, their project managers and outside consultants. U.S. Patent and Trademark Office director James E. Rogan, however, testified before the U.S. Congress in 2002 that intellectual property-related work accounted for 5 percent of the U.S. gross domestic product and employed four million people.

Successful project completion requires information sharing among company executives, project managers and these outside experts. However, project managers also must negotiate the landscape of confidential or proprietary information, and consultants must protect their own knowledge from competitors while they simultaneously segregate and secure multiple clients' sensitive information from each other.

For consultant Deborah Hoard and other project managers, the stakes may seem even higher. With more than 20 years experience in marketing and communications for Silicon Valley technology firms, she thought she had the implicit trust of her client's leadership. Yet, when the CEO visited the department head one day, Ms. Hoard was asked to excuse herself.

“It's been frustrating sometimes,” says Ms. Hoard, a self-described “fixer” for troubled tech-related communications projects and president of Net Results, Burlingame, Calif., USA. “But they want to err on the side of caution, and I understand that.”

Project participants must ensure trust with tools, policies and procedures that protect everyone's sensitive information. “My reputation is my livelihood and Silicon Valley is a very small community,” Ms. Hoard says. “A reputation is easier to maintain than it is to repair.”

Trust but Verify

“It all starts with the [nondisclosure agreement],” says Nathan Butler, one of Hoard's clients and group manager at data integration software provider Informatica Corp., in Redwood City, Calif., USA.

executive summary

After he was placed in charge of Informatica's marketing and communications efforts, Mr. Butler asked Ms. Hoard to standardize his department's hectic “oh, by the way” project management technique and catalog its undocumented efforts. She found more than 100 ongoing projects, where Mr. Butler had expected about 40.

Although Mr. Butler brought in Ms. Hoard on the strength of their earlier work together at Oracle Corp. and BroadVision Inc., a nondisclosure agreement (NDA) is a standard information protection measure at Informatica. Ms. Hoard says most of her clients insist on an NDA. “I take them all very seriously,” she says. “Loose lips do sink ships, and not only would my client be sunk because I said something I shouldn't have, but I would be too.”

Nondisclosure agreements typically define what a company considers proprietary information; the term of the agreement; what state or other laws apply for interpretation of the agreement; and acknowledgement of the parties' rights to legal remedy in event of willful breach. NDAs help everyone avoid potentially disastrous outcomes, says Joshua Bates, vice president of project management at Electronic Evidence Discovery Inc., Seattle, Wash., USA. “It doesn't become an issue for project managers very often,” he says, “but if it does it can be an ugly one.”

Nowadays, both clients and their consultants may demand mutual NDAs to protect each other's information, especially in situations where a client hires more than one consultant. Increasingly, employees of both companies also must sign confidentiality agreements that extend past the term of the workers' employment. “You can't think of just buying a product,” says Fumiko Kondo, managing director at knowledge worker enterprise consultant Intellilink Solutions Inc., New York, N.Y., USA. “You have to think of the people behind it who are accessing your information.”

NDAs can be customized to a company's needs in a particular industry or business relationship. Huntsville, Ala., USA-based Madison Research Corp., an engineering and information technology services contractor primarily to the U.S. Department of Defense, incorporates conditions governing the release of nonclassified information and technology transfer to parties in the continental United States.

Most clients are reluctant to share information about offshoring until they get to a comfortable stage due to political concerns about the practice.

—Ajay Kela, Ph.D.

“In general, we share only what's necessary to conduct business,” says Richard Selvaggio, Madison's vice president for systems sustainment. Arnold Maynard, Madison's senior vice president of systems acquisition, agrees: “Even with an NDA, the information shared must be carefully filtered to prevent providing a competitive advantage to a team member, subcontractor or consultant.”

What to Share

Of course, no NDA will protect companies or consultants from deliberate release of sensitive information. Therefore, the parties should identify sensitive information carefully and maintain internal processes and procedures that check information sharing activities for appropriateness.

Luis Augusto Camacho França, project management office manager for São Paulo, Brazil-based investment firm Italmisa Incorporações e Empreendimentos Ltda., says his company uses a three-step, pyramid-shaped chart to help determine access to information. Business risks, costs and contracts are limited to the project manager, executive project sponsors and an internal steering committee. The project plan, anticipated results and participant contact information may be shared with the project team and customer management, while project status, training and communications may be disseminated throughout the firm and to its consultants and customers.

“The client defines how open the information sharing will be,” says Anja Walter, owner and manager of consulting firm initii Unternehmensberatung, in Dietzenback, Germany. “Most of the internal project leaders define first internal and external [people] as kinds of users.” Computer systems administrators frequently will assign various levels of password-protected access to users depending on their need to access different types of information.

How much information is shared varies widely by industry, type of company and project, Mr. Bates says. As a legal services firm always conscious of litigation risk, Electronic Evidence Discovery zealously guards everything from project risk assessments to status reporting. By contrast, Mr. Butler says his marketing and communications project work for Informatica relies on open doors. “Full disclosure [to internal and external project participants] is absolutely necessary,” he says. “Otherwise, you're setting them up for failure.”

What information is shared is another story. Internal financial data such as accounts payable records that might affect a firm's market valuation or a public company's stock price, as well as personnel records that might include salary data, identification numbers and other private information, usually are secured tightly. However, public communications, project accomplishments and information necessary to clear project bottlenecks often are widely available to participants, if not freely available to the public.

Companies may rely on their NDAs or other written policies to guide consultants' information sharing activities. “We work in a collaborative environment with other company team members and subcontractors and adhere to our internal business ethics and standards for conduct, as well as our team members' processes,” says Jennifer Price, vice president of software engineering at Madison Research. But she recommends setting schedules to review who is accessing information and when, including when individuals' access should end.

The Personal Dimension

Even when NDAs are tight and internal controls are in place, clients' information sharing demands may be daunting. It took Ajay Kela, Ph.D., president of India operations for outsourcing service provider Symphony Services Corp. in Bangalore, India, a full year to get business applications developer Siebel Systems Inc. to agree to a press release touting his company's first year of outsourced software testing and support for the firm. “Most clients are reluctant to share information about offshoring until they get to a comfortable stage,” due to political concerns about the practice, Dr. Kela says.

Ms. Kondo says consultants also have to be wary, especially when working on a client's project with other consultants. Clients have far more control over the actions of their employees and even outside consultants than the consultants do over their clients or each other. Clients that expect multiple consultants to work together on a project rather than assigning each consultant a part of the project may tempt contractors to poach each other's employees and information, or risk finger-pointing if the project hits a snag.

Ultimately, information sharing policies and procedures depend on clients' and consultants' individual executives', and the judgement of project managers and employees. “Companies in the United States are a little concerned about letting their crown jewels go 10,000 miles away and not being sure what happens to them on the other end,” Dr. Kela says. Training and communication for outsourcers and consultants, especially if done in person, can help safeguard vital information along with the security guards and computer network access controls many companies already rely on. “There is a cost in employee morale” to the latter controls, Dr. Kela says.

“No one likes to be frisked coming in and out, especially as these are intellectual workers.” PM

William Hoffman is a freelance writer based in the Washington, D.C., USA, area.