Top Tips for IT Outsourcing

As data volumes expand, IT managers face a real-life digital Blob, one that's every bit as threatening as the one that faced Steve McQueen in 1958. In response, many professionals are reaching out -- literally -- for help. In the process, they're meeting a learning curve that's not always comfortable or predictable.

When it comes to data management, outsourcing of any kind -- hosting, collocation, or managed services -- has tradeoffs. Security is one: Some organizations don't trust their data to outsiders, especially on the Web. But pressure to cope leaves little choice: For many IT pros, the alternative to outsourcing is implosion.

In light of all this, it's wise to have a game plan. After consulting a range of industry sources, including analysts, users, and suppliers, we came up with the following list of tips for evaluating outsourcing options:

Decide what kind of outsourcing you need
Outsourcing options are legion: Applications can be hosted, using a software-as-a-service (SaaS) approach. Machinery can be collocated, allowing users to manage data themselves in rented facilities. Alternatively, multiple data center functions can be completely handed off to outside firms on a contract basis in a managed services model. There are also various combinations of these approaches.

Picking an option is often a matter of scale. If one or two applications are involved, such as email, hosting may be the way to go. Collocation may save the cost of a new external building to house IT infrastructure, but it will usually have to be staffed -- not a good idea for Web 2.0 service companies that will need to scale fast across geographies. To move out whole portions of IT, managed services may be best.IT staffers at survey software firm Vovici recently opted for managed services. "We wanted a 24-by-seven operation with international coverage," says Jeff Beardsley, VP of network operations at Vovici. Getting dedicated facilities and personnel on an existing global network was the only way they could achieve this quickly while maintaining round-the-clock uptime and ensuring future scaleability. So last month, Vovici signed a three-year, multimillion-dollar agreement to consolidate all of its IT in a single Savvis data center near Washington, D.C.

Consider a combination of options
Sometimes, outsourcing or hosting just one or two applications can mean enormous savings, particularly when it comes to email. Oberlin College, for instance, is planning to outsource its email to Google. In a memo to Oberlin's online community, Oberlin CTO John Bucher stated last week that opting for a free Google email service would be far more cost effective than spending at least $100,000 on an in-house solution or upgrade for this single, albeit major, application.

This kind of piecemeal outsourcing is gaining popularity as options for hosted services and SaaS offerings proliferate. According to a report published last fall by consultancy TPI, there is a move toward "smaller, shorter, more focused deals" among American firms. "The US market has shifted towards narrower and shorter outsourcing contracts. A major driver is the increasing popularity of the multi-sourcing model," said TPI managing director Duncan Aitchison in a prepared statement.

Look for hidden costs
In any outsourced situation, costs will turn up that were unanticipated at the outset. "A company needs to gather facts, because the budget for outsourcing can be surprising," says Greg Pierson, director of IT operations at Vovici.

Examples include staffing, particularly in cases of collocation. "In collocation, power, air conditioning, physical and network elements are rented. Everything else is do-it-yourself," says Vovici's Beardsley. That means that companies considering collocation need to factor in how many staffers on how many daily shifts will be required to keep applications up to speed.Other hidden costs may include extra backup, security, or monitoring products to ensure greater uptime in rented or managed facilities. Oberlin's Bucher, for example, states in his memo that Google may provide disaster recovery for email but not be able to meet the requirements to retrieve individual messages or attachments on request.

One important group of hidden costs pertains to parameters set by providers. "Look for hidden fees and surcharges should you exceed usage levels or cross thresholds," says analyst Greg Schulz of the StorageIO Group. Knowing in advance what levels of usage will be standard will help to avoid extra expense.

Examine all guarantees
As with any product, services come with guarantees. Mostly, these are in the form of SLAs (service-level agreements) that ensure a specified amount of uptime to customers. Look into these carefully to make sure you like the terms.

Hosted services, such as Amazon's S3 backup service, have very general terms. Last month, for instance, when Amazon S3 experienced an outage, customers were reimbursed in credit against their monthly subscription for exactly the amount of time the network was unavailable.

There are similar terms for many collocation agreements. In the wake of power failure in a San Francisco collocation facility, provider 365 Main provided an hour's rent abatement for affected customers, who technically experienced 44 minutes downtime when a planned failover technique didn't work. According to 365 Main's VP of marketing Miles Kelly, 100 percent of customers were retained.On the other hand, managed services agreements such as the one between Savvis and Vovici can involve multiple SLAs applied to distinct applications or elements of the IT infrastructure. Each of these will be negotiated according to specific customer requirements, and it all becomes part of the legal contract between the user and provider.

To Page 2

Determine how guarantees are backed up
To back up any SLA or guarantee, a provider needs the capability to monitor its service and account for uptime and downtime. According to Greg Schulz, this raises a number of questions, in addition to how and when a facility or application is monitored: "How are access and management procedures audited, and who audits or provides oversight? What type of reporting is available to you, and how often do you get to see it? Will it tell you how what you are paying for is being used, or what you are being charged for exactly?"

Make sure you can get help when it's needed
When a hosted service tanks, as Amazon S3's did last month, many customers may have trouble getting tech support by phone. According to Miles Kelly of 365 Main, customers may find it worthwhile to get a live representative they know they can phone in a pinch. Depending on the nature and importance of the contract, there may be a way to ensure that contact can be escalated. "Some people may want to get two degrees of separation from the CEO, or know they can phone the CEO if they can't get satisfactory help," he says. In many cases, this will have to be privately negotiated in a contract if it isn't part of a service.

Scope out facilities
Everyone we spoke with mentioned that it's best to find out where your supplier's facilities are located and visit ahead of time. While this may not be possible in the case of hosted apps, it's imperative when it comes to collocation and managed services."You should go see a facility firsthand," says Vovici's Jeff Beardsley. "We went to more than one location to check out the quality of the operation."

Site visits will reveal what may otherwise be hidden in terms of physical layout, redundant setups, and the ability to scale. One user of managed services, online gaming provider Mansion, enlisted services from U.K.-based Interxion after judging that facilities were accessible and scaleable. Interxion had to show Mansion that its facilities could could exceed 6 kVA per rack with associated cooling, while providing plenty of physical space for expansion as well.

Being on the spot will also show up any weaknesses in access control and/or physical security policies, and it will give you a chance to view your supplier's technology. Vovici, for instance, was impressed with Savvis's deployment of HP blade servers and clustering. "You always try to devise an architecture that meets the needs of the business," says Beardsley.

Check for SAS 70
Many managed service providers and collocation facilities boast compliance with the American Institute of Certified Public Accountants SAS 70 (Statement on Auditing Standard 70}. This could be important, because SAS 70 guarantees a certain level of security and best practices for a service provider. For example, the conditions for certification include personal background checks on any of the outsourcer's data center personnel.

Many providers of outsourced or hosted services will shove their SAS 70 certification across the desk immediately. Examples include AmeriVault, EVault, and InteleNet, to name just a few.If it's not mentioned, ask about it.

Check your providers' viability
As in any IT purchase, the outsourcing of functions like storage requires due diligence on suppliers. "If you are using a service or site to back up or archive your data, what are the safeguards that if it is a new company or service and they go out of business, you will be able to get your data back?" asks Schulz. Better plan ahead.

"You need to be sure you're dealing with a solid company," says Vovici's Pierson. His group checked peer references, including ones that weren't part of the vendor's prepared list of contacts. "We looked for unsolicited references, checking out blogs and so forth." If that sounds like a lot of work, it's far cheaper than paying a lawyer later.

Most of our contacts agreed that just because outsourcing may save capital and operational costs doesn't mean it takes less time to plan than any other IT purchase. Indeed, it may take more time to cost justify the necessary elements that make up any solid outsourcing agreement. In some ways, the process is magnified.

But one thing is clear: Outsourcing is an increasingly attractive choice for many organizations. Finding out how best to approach it is worth the time invested.Have a comment on this story? Please click "Discuss" below. If you'd like to contact Byte and Switch's editors directly, send us a message.