No abstract

No abstract

No abstract

Bringing externals in the critical business processes and having them assume some or all of the responsibilities associated with the critical business functions comes with information security risks whose impact, if materialized, could be disastrous for business and therefore warrants a meticulous and holistic approach for managing those risks. Compounded with the engagement of externals in the development process, risks facing a development project require robust risk management by the outsourcing organization. The organization should be able influence the security behavior of those externals and induce them to comply with certain secure development principles and practices. Delving deep into those risks brought about by suppliers, this study aims at offering a methodology in addressing the risks associated with commissioning some or all components of a would-be-developed product to externals and shows how those risks can be mitigated by controlling the security behavior of suppliers through well-tailored contractual provisions.

This Article uses a combination of doctrinal and comparative analyses to elucidate the most widely-used criteria according to which courts characterize an act as having a private-law nature. Further, this Article identifies the extent to which the Turkish State practice has embraced those criteria. To that end, this Article extracts two such widely-used criteria from patterns in customary State practice. In the end, the Article points out the extent to which those criteria are prevalent throughout the Turkish court rulings and concludes that Turkish caselaw is generally in alignment with the customary State practice in terms of the criteria used to determine a State act's private-law nature.