Not my job, Boss
Even when you've found an ideal ASP, can you trust its partners?
Virtually all ASPs promise secure servers, bulletproof uptime, and 24-hour instant customer service. But often, a third party is responsible for making good on this sweet talk. In the worst scenarios, the ASP is little more than a middleman between you and a host of companiesâ€"including the software makers that write the applications.
One e-tailer, which wishes to remain anonymous, noticed that while customers could place orders on its ASP-hosted site, the orders weren't being routed through its internal ordering system. Something was wrong. A manager called the third-party data center, Digex, to find the point of failure. A router wasn't working properly, but data centre staff couldn't pinpoint the exact problem.
Digex staff then allegedly told the retailer that because its service-level agreement was not with the data centre but with the ASP, there was nothing it could do. "It took us five days to get it fixed," says the retailer's CTO. "We've never been down that long. They didn't know if it was a software problem. It took a lot of work on our part to identify what the problem was. We had to get someone from 40 minutes away to get into [the data centre] to fix it in about two minutes. There was nobody there except the guard."
These are the kinds of headaches that get buried in the fine print of your contract. There's no sure-fire way to avoid traps with third-party partners, but it's crucial to find out how your ASP ensures that its partners will honor your contract. When the ASP has a problem with hardware, who do you call? Ask for a dedicated account manager so you're not making calls in a vacuum. Also find out how many people answer phones in customer support.
"If an ASP gets notified of a problem when the customer calls, that's too late. Bigger players have more control of the process and know where the points of failure occur," says Brice David, director of consulting at the Strategis Group.
Visit the ASP's data centre. Who owns it? How many people work there? Who has access to your hardware? Who fixes problems? Someone will be fiddling with the server that houses your dataâ€"and it probably won't be an employee of your ASP. Know the chain of command. Get a list of names and bios of people with access to your data.
"If I were the CIO, and it were my decision to outsource, I'd treat the employees as if I were hiring people in-house and look at their résumés," says Melissa DiDonato, vice president of services marketing at eOnline. "They aren't XYZ employee. They are supporting my mission-critical data. I'd want to meet the architect and the other employees. Never underestimate the power of people."
When touring the data centre, look at how the server cages are set up. Check the backup and disaster-recovery processes. Do competitors that use the same data centre have access to your servers? Is the climate controlled? How is security access enforced? Are you sharing your server with other companies? Can the routers easily be switched off?
Astaris's Tomko says the data centre walk-through is telling: "If I walk into an airplane hangar and the tools are strewn about, there is grease all over the place, packaging and trash [are] all over, and the people are in disarray, I don't want to fly that airline. Now compare that with an airline hangar where the workers are in white coats and the tools are packed away neatly."
When 99.99% isn't good enough
Lots of service providers guarantee 99.99 percent uptimeâ€"the so-called four nines. Sounds like bulletproof reliability, but it actually translates to about 50 minutes of downtime per year. Is that acceptable?
Companies that deal in critical functions such as online financial transactions, high-volume business-to-consumer e-commerce, or medical applications that handle patient info in real time, require 99.99 percent uptime, says former Gartner senior analyst H. Peet Rapp. But if even an hour of downtime is too risky, opt for five ninesâ€"99.999 percent uptime, or a maximum of five minutes of downtime per year.
Other applications, such as customer relationship management, generally don't need more than three nines (99.9 percent uptime, or a max of 500 minutes of outage per year). Human resources or sales-force automation apps that small or medium-size businesses use less than 50 hours per week would be covered with two nines: 99 percent uptime or a maximum of 5,000 minutes, Rapp says.
