Competing more effectively with a Managed Services Provider.

Competing more effectively with a Managed Services Provider. CIBER Whitepaper February 2012 1

Table of Contents Executive Summary...3 What is a Managed Services Provider?.. 5 Why Outsource?... 5 Total Cost of Ownership... 5 Speed... 5 Experience... 6 Performance... 6 The Benefits of a Managed Services Provider... 6 Who uses Managed Services?... 7 Who provides Managed Services?... 7 Security concerns and Managed Services... 7 Physical Security of User Data... 7 Internet Link Security... 8 Access to Customer Data... 8 Access to Customer Networks... 9 Is a Managed Services Provider right for your organisation?... 9 What to look for in a Managed Services Provider?... 9 Conclusion... 11 2

Executive Summary Today s savvy enterprises understand that IT managed services help them change the economics of their IT operating environments for both applications and infrastructure. Whether your business is grappling with the Total Cost of Ownership (TCO) of maintaining your application portfolio, or an impending capital outlay for an overdue infrastructure technology refresh, outsourcing to a Managed Services Provider can help you deal with the significant challenges of managing and maintaining your complex IT environment. Customers can trade the worry of unpredictable IT management costs for an assured level of service at a fixed, pre-arranged cost and the comfort of knowing that professional operations people are making sure that service levels are being met. Drivers behind outsourcing management operations include: Continued migration toward more complex enterprise technologies and applications On-going scarcity of in-house technical expertise Heightened attention to assuring business continuity in any contingency Availability of new outsourcing options Cost containment, reduction and/or stability Manage or eliminate risk Provide consistent quality and reliability Non-core business function (operations) Need to re-deploy staff resources Capacity limits reached Today s Managed Services Providers are increasingly offering flexible support options with customers for controlling applications, networks and infrastructure. By handing over responsibility for application and information management to a company that specialises in these services, organisations can reduce costs, improve security and provide 24x7 services to offices all over the world. 3

The benefits of working with a Managed Services Provider can be great, but it is not a choice that should be taken lightly. There are many factors to consider when making your decision, that s why CIBER has developed this whitepaper. In it, we will cover: What is a Managed Services Provider? A quick overview of what Managed Services are and how they work. Why outsource? There are many reasons to outsource your enterprise application services to a managed services provider, and we will discuss a few of them in this section. The Benefits of a Managed Services Provider - what can you realistically expect. We cover just a few of them here. Who uses Managed Services? Who provides Managed Services and Outsourcing? There are a lot of organisations that provide some variation on Managed Services. We give a brief overview of the marketplace today. Security concerns and Managed Services. Customers should be aware of security concerns associated with using a Service Provider. We cover a few of the major considerations. Is a Managed Services Provider right for your organisation? Only you can answer that question, but included are a few of the questions you should ask to determine the answer. What to look for in a Managed Services Partner? Naturally, CIBER would welcome the opportunity of working with you! But, in the interest of full disclosure, here are some evaluation criteria you should consider. The decision to outsource all or part of your enterprise application support is one that can have a major impact on your business. Continue reading to learn more about it. 4

What is a Managed Services Provider? A Managed Services Provider offers a form of outsourcing wherein a third party vendor manages and monitors enterprise applications, systems and networks - anything from ERP, CRM or firewalls to proprietary e-business applications - or network infrastructure. Services are provided on a contractual basis - charges are determined based on disk space consumed, hardware and software provided, network bandwidth required, services associated with the administration of the network, systems, security, and applications and operations (monitoring and job execution). The arrangements are governed through Service Level Agreements (SLA s) that associate costs with a particular level, or type of service. A Managed Services Provider is different from an Application Service Provider (ASP) in that it permits organisations to outsource management of their applications without giving up control over the applications themselves. The Managed Services Provider is responsible for making sure that all systems under the agreement are up and running, and fixing them when they are not. Because fees are charged on a contract basis for particular types of service, costs are kept to a minimum. Monitoring of the systems is provided on a 24/7 basis by the Managed Services Provider, so organisations don t have to worry about retaining staff to handle that non-revenue producing task. However, the application remains under the ownership of the client, so the client is protected in the event the Managed Services Provider goes out of business, or the client chooses to bring the outsourced functions back under in-house control. Why Outsource? Total Cost of Ownership The total cost of ownership for an enterprise application includes not just the license for the software itself, but all the infrastructure and personnel required to support the application. By outsourcing with a Managed Services Provider, infrastructure and staffing costs are reduced. In addition, costs associated with downtime, risk and lack of predictability can be managed and reduced. Speed Outsourcing your enterprise applications with a Managed Services Provider lets you realise the advantages of new technologies faster. By eliminating the lengthy process of evaluating, purchasing and installing the underlying hardware and networking infrastructure, an organisation can save weeks, even months, off the total time to implement an enterprise system. 5

Experience In the ideal world, every corporation would be able to afford to keep in-house experts in every IT field on hand. Unfortunately, in the real world these employees can be hard to come by, and it can be nearly impossible for your staff to have all the knowledge to handle every situation. A Managed Services Provider has access to a wide resource pool of trained engineers, system administrators and application experts to ensure that your needs will be anticipated and met. Performance The only constant in today s environment is change, and your IT systems have to adapt to it. Outsourcing your applications to a systems management expert ensures consistent, scaleable performance as your user communities grow. Outsourcing not only minimises up-front risks, but also allows you to take advantage of your outsourcing partner s acquired knowledge of managing complex enterprise application environments throughout their lifecycle. The Benefits of a Managed Services Provider The benefits of outsourcing services with a Managed Services Provider include: Ability to focus on core competencies - handing over infrastructure maintenance to a third party allows an enterprise to focus on mission-critical business issues. Higher quality service - economies of scale combined with service level agreements can translate into increased operational efficiencies and improved accountability versus an in-house team. Access to new skills and technologies - outsourcing provides access to resources not available internally. Greater flexibility - outsourcing allows an enterprise to react quickly to changing market conditions, fluctuating demand and increasing competition. Lower long-term capital investments - the Managed Services Provider takes ownership of and responsibility for managing your infrastructure, eliminating the need for on-going investments in IT equipment. Consolidation of infrastructure allows a further reduction in costs. Improved predictability of costs - outsourcing delivers predictable yearly costs for infrastructure management, helping organisations improve their long-term expense planning and budgeting. Assistance with organisational changes - outsourcing allows your organisation to more efficiently build and integrate new systems during or shortly after consolidations, mergers, acquisitions and joint ventures. Assistance with globalisation - companies moving into international markets can rely on the global capabilities of their outsourcing partners to help them make the move. 6

Who uses Managed Services? Typical customers of a Managed Services Provider are those who either do not have the resources to handle their own enterprise application management in-house, or are looking for ways to reduce the costs and unpredictability associated with managing their applications. Who provides Managed Services? Managed Services are provided by a number of different types of organisations. A few examples include: The services arm of a hardware vendor such as ones that sell PBXs, gateways, routers or servers A systems integrator A Value-Added Reseller (VAR) A traditional consulting firm Pure-play Managed Services Providers Hardware vendors bring in-depth knowledge of their particular solutions. Systems Integrators, VAR s and consultants have traditionally claimed more experience in designing, meshing, and optimising multi-vendor communications environments. However, this distinction in capabilities is rapidly disappearing. Recognising that today s networks and applications inevitably require multiple brands and platforms, hardware vendors have made great strides in earning certifications and forging partnerships across a variety of product vendors (including their direct hardware competitors). SI s and VAR s continue to hone their multi-vendor skills, with many focusing on gaining expertise in a specific application area and/or vertical industry segment. Security concerns and Managed Services There are a number of security issues that should be considered in regard to the Managed Services model. Customers should feel entirely comfortable with the way their information security will be handled by any potential Service Provider. Some of the areas to consider include: Physical Security of User Data In the Managed Services model, customer data is stored off-site, away from a customer s location, on storage equipment and networks belonging to either the customer or the Managed Services Provider. 7

The equipment resides at an operations centre owned and run by the Managed Services Provider - so the physical security of the equipment is dependent on the Managed Services Provider s ability to provide the appropriate level of security. Some questions to ask of the Managed Services Provider are: 1. Is access to the operations centre controlled? How is it controlled? 2. If the operations centre is a shared location (i.e. if it serves more than one customer) how does the Managed Services Provider secure individual customer equipment and information? 3. How well prepared is the operations centre for potential disasters, such as fire, earthquake or other acts of God, or even a possible terror attack? Some additional questions to ask here include: Is the operations centre fully equipped with fire alarms and fire suppression systems? How regularly is data backed up? Where and how are these backups stored? Does the Service Provider have redundancy of equipment as part of the service? Does the Service Provider have a documented disaster recovery plan? Internet Link Security The security of the Internet link is an important consideration. Failure to provide appropriate security at this level can leave both the Service Provider and its customers open to potential hacking. Managed Services Providers should have the capability to deliver their solution either through the customer firewall, or through a custom VPN solution. Access to Customer Data It is inevitable that Managed Services Provider employees will have access to customer data files stored at the operations centre. This is an area of some concern, but it is helpful to compare the services provided by a Managed Service Provider to those provided by a bank. Our trust in the banking system means that we never give a second thought to the fact that many bank employees have easy and detailed access to all of our financial transactions. We trust the bank to protect our information, providing the appropriate level of access only to those employees who have a need to know it. We also trust those who do have such access, to treat the information confidentially. 8

Similar considerations are also inherent to the Managed Services Provider model. Potential customers should ask what type of access the Managed Services Provider employees will have to their information, how will it be used, and what sort of safeguards are in place to protect against misuse. The Managed Services Provider should have business practices in place to ensure password changes and protection of customer data is reviewed on a regular basis. Access to Customer Networks In some instances, Managed Services Providers need to have a software presence in the customer environment in order to provide their services. Typically, this involves the use of agent software to facilitate communication between the customer equipment and the Service Provider via the Internet. This is used to perform remote management functions, such as remote control and monitoring. Given this level of remote access to client equipment, it may also be possible for Managed Services Provider employees to access individual client devices. This presents a certain level of risk, and potential customers need to be comfortable with this risk. Is a Managed Services Provider right for your organisation? For enterprise customers, the decision to keep control of networks and applications in-house or hand it over to a Managed Services Provider usually hinges on five basic questions: 1. How much does each option cost? 2. How much control do IT and functional managers want or need to have? 3. How comfortable is the organisation with the potential risks involved? 4. How thin are internal resources currently spread? 5. How long does the company think the Managed Services Provider will stay in business? What to look for in a Managed Services Provider The best Managed Services Providers are those that are stable, and have the infrastructure, tools and resources to provide high quality monitoring on a round-the-clock basis. Stability is critical, because you need to ensure that any Managed Services Provider you entrust with your missioncritical software will be around to service its contract. The Service Provider should also provide resources that are well-versed in the particular applications being outsourced. This will help minimise any potential problems associated with entrusting applications to a third party. 9

When evaluating a Managed Services Provider, look for the following: 1. Infrastructure - An obvious requirement for any Managed Services Provider is that its infrastructure meets your needs. This includes not just the platform that your applications need to run on, but also whether or not the Managed Services Provider has the ability to support the needs of a large data centre on a round-the-clock basis in any situation. One of the value propositions of a Managed Services Provider is its ability to provide reliable, high quality information - to do this, the Service Provider should have back up procedures and equipment in place, along with appropriate staffing, to ensure 24/7 availability of your information. 2. Application Experience - Look for a Managed Services Provider that has both the infrastructure to run your applications and the software knowledge that will ensure your applications run the way you want them to. Managed Services Providers must be able to respond not only to your platform and network requirements, but to application problems as well. 3. Security Expertise - You re handing over critical business information to a third party - that party has other customers as well, so you need to make sure that the company you contract with has the ability to adequately protect your information. Look for an organisation that has extensive network security resources. 4. Stability - Possibly, the most important point to evaluate is what are your Managed Services Provider s long-term prospects? Make sure this organisation will be around for the long haul. If your Managed Services Provider goes out of business, finding a replacement could be a headache. Look for stability indicators such as diversified offerings, longevity of the organisation, and experience of the organisation s management team. 5. Processes - Because many Managed Services Providers are start-ups, it s important to ensure that they actually have processes in place that govern how they will operate. When handing over your applications to a third-party, it is important to ensure that surprises are kept to a minimum. 6. Scalability - Look for indications, such as size, revenue, and resources that indicate the Managed Services Provider s ability to react to changes within your organisation. Does the company have the wherewithal to make investments in new technology should the needs of your organisation change, or are you likely to outgrow their offering within the service contract period? 7. References - There s no better indicator of how a Managed Services Provider will handle your business than how it handles others. Look for customers that indicate the Services Provider s ability to scale, and for experience in your industry, or a multitude of industries to ensure that the Services Provider is aware of any regulations affecting your industry. 10

Conclusion The decision to work with a Managed Services Provider is not one that any organisation should take lightly. While the lower cost of a Managed Services Provider may compare favourably with the cost of managing your own applications and services in-house, it does result in some loss of control over the people and processes that manage your data. However, for those organisations who are struggling with the costs associated with managing critical applications and processes, and who are willing to accept the potential risks involved, choosing the right Managed Services Provider can result in lower costs, better management of data and processes and in some cases, improved security and control over your data and the applications that contain it. Choosing the right partner is critical. The organisation you choose should be an expert in network security and infrastructure, should have experience running the applications your organisation uses, and should be a partner you can trust to provide cost-effective services securely and reliably today, and in the future. The partner should be able to provide infrastructure and support to meet not just your current needs, but your future needs as well. CIBER is such a partner. If you would like to learn more about us and the services we can provide, please contact us via phone on 0870 000 0204 or visit our website www.ciber.co.uk. 11