The one thing eCollege doesn't outsource and says it never will is its call center. While call centers are traditionally a prime outsourcing candidate for many companies, eCollege runs a "private-label," in-house help desk service that it views as strategic to its business.

"Part of [eCollege's] value proposition is quality of the student experience," Resmer explains. That customer service is paramount to eCollege, and the company is best equipped to provide that itself. "I'm a true believer in outsourcing, but you have to outsource wisely," he adds.

Lowes points out that you can't outsource regulatory compliance. He advises having a chief security officer focused on security requirements that apply to the outsourced community, such as policies for access control.

"For example, it's a violation of the Sarbanes-Oxley Act Section 404 if you don't know where your software is being developed or if your outsourcer has further outsourced your development to someone else," Lowes warns.

Offshore considerations