Outsourcing is a strategy increasingly being used by organisations to reduce costs and increase value. Outsourcing, however, has its risks. As organisations look to push out more of their custom software application development needs to outsourcing partners, careful planning is required in terms of building stringent software security requirements into contracts and creating a process and metrics to ensure that those requirements are met. This report examines outsourcing practices from 200 of the largest organisations in the UK and the US and provides pointers as to how the most experienced outsourcers are putting in place effective processes to drive the risk out of outsourcing.