As your dependence on e-commerce, intranets, and extranets increases, so do the demands on your already overworked and understaffed IT department.

Many midsize businesses have attempted to lessen the strain by purchasing network-management software from the likes of Hewlett-Packard, Tivoli, BMC, and Microsoft. These tools may improve manageability, but they're complex and notoriously difficult to implement. And for smaller companies, they're simply out of financial reach.

These factors have given rise to a new breed of company called the management service provider (MSP). By MSP Association (Web site) definition, an MSP delivers "information technology infrastructure management services to multiple customers over a network on a subscription basis." Market-research firm Meta Group places the MSP market at US$75 million to $100 million. And The Gartner Group predicts the market will expand to $3.2 billion by 2005.

The MSP value proposition is simple. Instead of purchasing a management tool, training staff to use it, and upgrading or replacing hardware systems as necessary, a company can outsource the entire process to an MSP, and be up and running in a fraction of the time -- and at a fraction of the cost. MSPs can typically start managing systems within 15 to 90 days, compared with the six to 18 months required to implement an in-house management system. Contracts are generally for a year or less, placing the onus on MSPs to deliver value quickly.

This rapid delivery schedule offers strategic advantage to those companies for which fast time to market is crucial. And the MSP pay-as-you-go subscription model eliminates the initial infrastructure investments, lessening the strain on internal IT resources and taking potential failure of network-management software implementations out of the equation. In addition, MSPs are responsible for maintaining and upgrading their software offerings as appropriate, so customers don't need to concern themselves with software updating or licensing fees.

One size doesn't fit all

Services vary significantly from one MSP to another. Some offer a broad range of management services, while others concentrate on vertical areas such as security, storage, content delivery, and application performance and testing. Such wide coverage makes it critical for customers to be diligent and have a clear sense of their needs before they start the MSP selection process.

Technologies employed differ among MSPs, too. Some license framework software from network-management vendors, while others have developed proprietary tools to pull data from managed devices. Some MSPs deploy onsite servers that deliver information back to a data centre for analysis; others deploy agent technology to collect pertinent data.

Most MSPs offer a dashboard-like Web interface through a password-protected information portal. This common interface reduces training time for IT staff. The portal aggregates data from various programs, and presents pertinent graphs and information in a unified interface. Administrators can then monitor such items as server load, network capacity, and application availability, and track IT investments in real time. MSPs can also send alerts via email or pager once particular thresholds are reached, to help administrators nip problems in the bud.

With an MSP monitoring critical systems, IT staff can concentrate on other areas, such as strategic initiatives and emerging technologies. IT management won't need to hire systems-management experts, who are difficult to find, much less retain, in today's competitive labor market. The model provides a middle ground between completely outsourcing management responsibilities and maintaining total internal control.

Meet the players

We spoke with several MSPs: Luminate, Nuclio, PatchLink.com, SilverBack Technologies, SiteLite, TriActive, and WebPartner, to give you an idea of the processes, technologies, and implementation strategies they employ.

Luminate provides self-service monitoring services for Oracle databases, SAP R/3 supply-chain management systems, and the Windows platform. The service monitors operating-system health, hardware metrics, and application status. It uses Mamba, a proprietary tool, to collect data and send it to the Luminate data centre for analysis, running reports against a series of "rules of thumb." This expert analysis generates conclusions IT staff can use to fine-tune and optimise system performance.

Nuclio offers proactive network, Web-site, and application-monitoring services. The MSP licenses Hewlett-Packard's OpenView network-management software and customises a Web-based front end to meet a client's specific needs. The Web portal aggregates data from the OpenView engine and 28 other applications, providing clients with snapshots of overall system performance. With the click of a mouse, administrators can drill down for details.

PatchLink.com developed WebConsole, a Web-based tool for remotely managing NT servers. By hosting the application, PatchLink provides self-service assistance to IT managers. A software-distribution module that requires an agent pushes software updates and applications to managed desktops and servers. PatchLink Monitor provides a view of external e-commerce services, simulating credit-card transactions and testing database processing. The PatchLink Web site provides a community where users can ask questions to help resolve issues. Its HelpDesk module includes a knowledge base and an incident-reporting mechanism.

SilverBack Technologies provides security-scanning, asset-management, topology-mapping, root-cause-analysis, and monitoring services. Using InfoCare, a Linux-based server appliance installed onsite, SilverBack collects data and sends it back to the data center for analysis. SilverBack has developed middleware that collects information from the different modules and presents administrators with a unified Web interface. Administrators can quickly glance at the screen to ascertain system status.

SiteLite focuses on managing production client/server systems on a variety of platforms. Resident experts monitor Linux, Oracle databases, Windows, and Web-application servers such as IIS, WebLogic, and ColdFusion. SiteLite provides proactive systems management, applying patches and fixes as needed. It goes beyond basic monitoring by taking on problem resolution from beginning to end. The company will work with clients to support custom applications, if needed.

TriActive focuses on enterprises looking for a self-service MSP. The company has licensed Tivoli's network-management software, and also offers asset-management, application-healing, help-desk, and antivirus services. TriActive can manage down to the desktop level by installing agent technology on managed PCs. A virtual private network (VPN) router provides direct connectivity from the client site to TriActive's data center.

WebPartner concentrates on monitoring front- and back-end e-commerce sites, database servers, and networking hardware. The service measures traffic patterns and server health, and aggregates data into a dashboard view accessible from a Web browser. It either installs an onsite server to collect data, or uses agent technology

Proceed with caution

The MSP model is in the process of defining itself and staking out its turf. Although it sounds appealing, there's still reason for caution. For many years, IT departments have controlled and managed their own internal systems. Deciding to outsource an entire IT infrastructure, or portions of it, is a choice that shouldn't be made lightly.

Security is one important area of concern. MSPs are addressing this issue in several ways, including establishing direct VPN connections between customer and data centre, and using Secure Sockets Layer (SSL) over HTTP connections. Be sure to investigate the MSP's internal security procedures to ensure data is kept from prying eyes.

Some IT staff may be reluctant to use MSP services because they may view them as a job-security threat. This is a valid concern if plans are to fully outsource management tasks, using companies such as CenterBeam, Everdream, and Loudcloud. For this reason, many MSPs are positioning themselves as enablers complementing, rather than replacing, IT staff functions.

The Internet is the lifeline between MSP vendor and client. Because Internet connectivity can be lost on occasion, the Net isn't the most reliable communication medium. If you lose your Internet connection, your business may not be adequately monitored and protected, a potential concern for companies outsourcing the majority of their infrastructure. Some MSPs, including SilverBack, address this by placing a server onsite. The server collects information for up to seven days during an extended outage.

The MSP market is new and relatively unproven. Some MSPs will go through mergers and acquisitions, and others will fall by the wayside. Companies that offer a wide breadth of services may acquire niche companies to help fill out their portfolios. Or, co-location hosting companies such as Exodus, which is actively partnering with MSPs, may decide to go the acquisition route. Framework software makers, such as BMC and Tivoli, may even enter the MSP market to license their software to MSPs.

What to look for

With such a diversity of MSP services, you need to be a smart shopper. Here are some tips to help ensure the MSP selection process is efficient.

First, define the issues you want to solve and itemize your business procedures. With so many MSPs out there, it's important to prioritise your needs to eliminate some vendors from consideration right off the bat.

Next, determine exactly how much of your infrastructure you wish to outsource, keeping in mind the risks associated with this decision. Think about whether you want to outsource the management of the company Web site, specific processes such as security or storage, or your entire IT infrastructure. The risk is greater if you're using the MSP for mission-critical access to applications as opposed to just monitoring tasks.

Another critical issue to consider is the level of problem resolution you need. Some MSPs alert you to potential and critical issues but leave problem resolution to your IT staff. If your staff needs expert assistance to help solve the issue, some MSPs will undertake problem resolution from start to finish. Others will refer you to channel partners specializing in those areas.

Taking the time to thoroughly investigate potential MSPs will help prevent service disruption down the road. If possible, arrange a visit to the MSP's facility to examine its procedures and data-centre infrastructure. Your MSP's solution should be scalable to grow with your business. It should provide consistent levels of service regardless of how quickly your business grows. Ensure you're satisfied with the MSP's security processes, redundancy levels, and backup procedures.

Carefully review the MSP's technical solutions, and think about how they'll integrate with your current infrastructure. For example, some MSPs require the use of agent technology to generate performance data and increase manageability. But using agents requires a deployment process that may make it more difficult to drop the service. Also, determine if you're comfortable with remote monitoring, or if you'd rather an MSP place servers internally to collect data.

Ask prospective MSPs for a list of references, and call them to find out their experiences. It may be worthwhile to ask for an entire customer list and randomly call companies for feedback. If the customers are having great experiences, the MSP has nothing to lose by divulging this information. Also find out how long the MSP has been in business. Depth of experience is an important consideration, with so many new vendors entering the market.

MSP executives have varied backgrounds, ranging from system integration and consulting to network management and software development. Try to ascertain how the vendor is dealing with the tight labour market for technicians.

Once you've decided on an MSP, carefully define a service-level agreement (SLA). An SLA is the contract that specifies the level of service an MSP will provide, and how your company will be reimbursed if service interruptions occur. Consider adding contract language to address what happens in the case of an MSP merger, acquisition, or insolvency. Another key factor to include is an out clause outlining the procedure for dissolving the relationship with the MSP.

The SLA should clearly define and divide responsibilities between your IT staff and the MSP. It's critical to outline the routing of trouble tickets, and determine who gets alerted when specific events occur. Businesses should be proactive in informing the MSP of hardware and software changes; this open communication between parties makes for a better working relationship.

The MSP model is relieving specific pressure points for many businesses. The most successful MSPs forge strong partnerships and stress a proactive, preventive methodology. Although the model is still maturing, be aware of the possibilities these services provide. By thinking about how your business processes will integrate with MSPs, you can realise productivity gains, expand strategic initiatives, and more effectively manage internal systems.

Copyright © 2009 CBS Interactive, a CBS Company. All Rights Reserved.
ZDNET is a registered service mark of CBS Interactive. ZDNET Logo is a service mark of CBS Interactive.