How do you share information with third parties during due diligence? In the past, companies set up a secure physical data room and all the parties came with their cartons of documents. Even today, many ship data CDs via FedEx. Most exchange email with attachments among the various parties. Email attachments are utterly insecure in most cases.

EURIM, the European Information Society Group, published a report some years ago touting online document sharing as the wave of the future, even for confidential information. EURIM’s focus primarily was on government agencies. One of its conclusions: “Advances in computing, particularly in networking and security, are making it possible to reduce identity theft through secure data sharing.”

That might not sound reassuring to CFOs faced with sharing sensitive information during the M&A process, compliance audits, and such. Data theft more than identify theft is their immediate concern. Nobody wants their financials, business strategies, customer lists, unannounced product specs, or anything else compromised.

Accellion, Inc., which provides secure managed file transfer, avoids the dangers of sending email attachments in the clear over the Internet. Its latest survey found customers coming to it because of concerns about security, email attachment size limitations, and frustration over FTP complexities.

However, SaaS and cloud computing are combining to deliver what may yet prove to be a faster, easier, and cheaper solution that can provide near bullet-proof security. These services often are referred to as online collaboration space or online data rooms.

The problem: Online collaboration space is available at many Web sites, ranging from ElephantDrive and 4shared at the low end to IntraLinks and Brainloop at the high end, with dozens more in between. You will have to look closely at what each site offers in terms of features, particularly security. Just having a password-protected log-in is absolutely NOT sufficient security for important sensitive corporate information.

What kind of security should you look for? At a minimum, you want:

• Strong encryption (Advanced AES, 256-bit) for documents, both while they are there and when they are in transit

• Strong authentication (two-token authentication)

• Digital rights management to control documents wherever they end up

• Operator shielding, which prevents the online vendor from accessing the data or the encryption keys

• Traceable audit trails and watermarking of documents

These features represent the acceptable bare minimum. You will have to grill each online vendor thoroughly and press for the details on how each implements security and the level of control you have. In short, you want the vendor to maintain a highly reliable online space while you and only you control what happens to the documents within that space.

Once you have been assured that the online collaborative space is secure and under your control, the advantages of an online data room for due diligence, M&A, and similar activities involving sensitive documents make it a no-brainer. You may never ship data CDs overnight via FedEx or send attachments unencrypted again. ###