Managed IT Services: In-house or Outsourced?

Gone are the days when you could manage your entire IT infrastructure using a

handful of people. Today, the number of IT functions across all enterprises has

grown by leaps and bounds. IT infrastructures are becoming increasingly complex,

and crossing geographical boundaries. In such a case, you need a bigger team to

manage your setup. The question that arises from this is, whether to build an

inhouse team to manage it all, or outsource parts of it to a third party.

Increasingly, more companies are using the latter option and outsourcing

parts of their IT infrastructure to managed IT services providers. This leads

one to several questions. How do you decide which parts of your IT

infrastructure to outsource and which ones to keep with your internal team? How

many service providers should you approach and what should be the duration of

the contract with them? What should be the terms in such a contract? For which

services can you easily find a managed IT service provider, and how should you

choose the right managed service provider?

Today, there's a huge market for managed IT services, and in this story,

we'll analyze the key trends that are shaping this market.

By and large, the easiest functions to outsource are the non-business

critical ones. The difficult part is in defining what's non-business critical,

since IT is increasingly being subjected to business norms. Something that's

extremely business critical for one organization, could be 'not-so-critical' for

another. That's why, there isn't a 'one size fits all' answer to this.

The logical way to decide between outsourcing a function or keeping it

inhouse is to weigh both options in terms of cost and downtime. How long would a

service provider take to resolve a problem? If you needed it to be done faster,

how much would be the additional cost for it? Would it be more cost effective to

have inhouse staff handling it instead?

For instance, increasingly, most companies are implementing remote

infrastructure management, and many others are outsourcing the management of

their branch offices. In both cases, if you were to do it inhouse, then you

would need to find the right manpower and train them. As the first one can be

quite a tedious and monotonous job, you would also need to keep them motivated,

as retaining the manpower would be a challenge otherwise. In the latter,

ensuring that they're trained and equipped enough to manage the branch office is

a task in itself. It makes sense therefore, to outsource such functions to a

service provider. Moreover, now managed IT service providers are getting the

attention of CIOs on more focused areas such as security, storage, WAN, etc.

Today, CIOs' role is to formulate the IT plans, assess requirements and

manage all IT functions. In order to outsource any IT function, you should

divide your IT functions into smaller groups, and then identify the areas that

can be outsourced, be it hardware or software. After deciding what to outsource,

then the next challenge is to choose the right vendor as per the IT budget and

quality of service desired.

The advantage of using managed IT services is a CIO can concentrate on new

projects without worrying about infrastructure-related issues. Even if something

were to go down, it would be the managed service provider or MSP's job to

rectify the same.

Why outsource?



If you manage the entire IT yourself, then you need an IT staff in-house

that is well trained to handle the technologies, platforms, hardware and

software that you use. Secondly you have to pay for their salaries, training,

etc. Further, due to the high attrition rate in the IT industry, your

organization's HR department will need to spend time finding new professionals

with sufficient skillsets and in training them. While this is happening, the

technology outside is also changing. If you change your deployed technologies,

you again need to train your IT staff. After that you have issues like managing

multiple vendors and their associated AMCs and costs. The more the number of

vendors for an organization, the more complicated things become when a problem

occurs. So, try to minimize the number of vendors, as much as possible. On the

other hand, the MSP can act as a single-point of contact for all your needs.

While some vendors specialize in one or two areas (like networking, hosting,

etc.) many others provide end-to-end solutions. The end-to-end providers further

outsource parts of their worok to other down-level MSPs.

With the kind of services being offered today, you can outsource your entire

set of IT functions, including implementation, products, sourcing, and

maintenance. You can even ask the vendor to set up the whole thing for you, run

it for some time and eventually hand it over to you to run after you have the

required skillsets. Such contracts are fairly long term, to the tune of 10 years

and longer, and the deals are worth huge amounts of money. The feasibility of

such long-term deals needs to be evaluated. Does it make sense to be locked in

with a single MSP for such a long period? What if it doesn't work out after the

initial few years? The best approach in such cases would be to get into an

annual contract and renew it based on what the MSP has delivered. Alternately,

organizations can also choose to outsource only parts of their infrastructure to

an MSP, and sign short-term contracts. We'll now look at the services that can

be outsourced.

Web hosting services



This is the oldest service that can be outsourced, and just about every

organization avails of it. Organizations can either take up space for their

website/portal or for their email. What's new is that increasingly, service

providers are bundling more features in their hosting services. Managed mail

services, for instance, are a key trend nowadays. So in addition to providing

basic mail services, a service provider would also offer security services like

anti-virus, anti-spam, etc. For web-hosting, the service provider would offer

things like content filtering, secure access, etc.

Business applications



This is another area which is picking up slowly. The main concern for a CIO

is to provide seamless performance on mission critical applications. In order to

do this, a team of IT experts is needed to keep continuous vigil on the

applications performance, delivering quality of service and maintaining 24x7

uptime. As finding and retaining experts for such a job is not easy, outsourcing

this job can be quite feasible. Another trend that's taking shape nowadays is

SaaS (Software as a Service) where the application is hosted with an ASP

(Application Service Provider). It's a hot new trend, but out interactions with

several users has revealed that they're reluctant to opt for this model. Several

reasons have emerged for this. One of them is customization. Users are

apprehensive of the level of customization that a SaaS vendor would be able to

offer.

Infrastructure mgmt



There are several things that come under Infrastructure management. These

include the hardware, network, and WAN links. These can be further broken down

as well, depending upon the size of your network. The hardware, for instance,

can be broken up into desktops, servers, and even power and cooling equipment in

the datacenter. The network can include switches, routers, and even WAN links.

Increasingly, organizations are consolidating their IT infrastructures and

providing remote connectivity to the branch offices. In such a case, ensuring

that the WAN links are up is absolutely critical. For an organization, such as a

bank, with hundreds or thousands of branches across the country, hiring manpower

to manage all these WAN links can be a nightmare. This is where an MSP can

proove to be very beneficial. The MSP would do all the running around for you,

which could involve things like several trips to the telecom provider or the ISP

for lodging complaints.

Security



In an enterprise, there are so many other security issues including identity

management, intrusion detection, information security, etc. Even rolling out

security-in-a-box solutions has its own challenges. Identity management today

comes in several forms, starting from user authentication till signing him off.

In the interim, the process also needs to ensure smooth and transparent handoffs

to external applications and devices. Enterprises have a lot of choices today in

what they can implement. Monitoring and proactive control of the security

deployments vis-a-vis their health and performance are now done on an online

basis. Here, the MSPs are tasked with managing the security of the servers and

clients, along with the network and the



applications that run on it. Security devices are now built around the
Integrated Services Architecture, a model that allows networks and equipments to

converge. The problem with security is that if there is an outage, the

enterprise can have big losses and that too not just confined to business part.

Therefore, enterprises going in for managed security should first quantify the

losses. You need to evaluate the types and value of these losses and then

evaluate the prospective MSP on the basis of this. They should also make such

terms a part of the SLA which makes the MSP responsible and more interactive.

Storage and replication



With the rapid growth of IT, storage requirements are increasing in an

enterprise like anything and managing it is becoming a big headache for the CIO.

They get requisition for additional storage requirements on a regular basis

despite storage capacity planning. Managed service providers are also offering

storage management and replication services. By outsourcing the storage and

replication process, CIOs don't have to worry about storage outage for their

application or new projects. They can get any amount of storage, whenever they

want, plus get the benefits of data security and quality of service. Reliance

has recently started giving managed storage services, where they provide data

security and replication services.

Disaster recovery



Every enterprise application and data plays a critical role in business.

Therefore the CIOs can't afford to have any negligence or downtime in that part

at any cost---the reason for the concept of disaster recovery gaining importance

these days. In today's scenario every big or small enterprise has some kind of

offsite disaster recovery site, so that if business applications go down from

the core, the disaster recovery mechanism will shift IT operations

(mission-critical applications) to another DR site without losing the business

continuity. To maintain a DR, enterprises would require skillsets, connectivity

and infrastructure on another location, which means huge IT budgets. A major

challenge for a CIO is to manage both the sites in sync with their IT team. Or

if for any reason DR doesn't work at time of crisis then blame comes to CIO. To

ease such pressures and to save IT budgets too, CIOs are now thinking on moving

toward managed DR services.

Remote monitoring & management



In order to have smooth functioning of applications running inside your IT

infrastructure, a continuous monitoring team is required full time plus experts

who can analyze the performance of your IT infrastructure and take appropriate

actions in case of performance degradation. Same also applies to network

monitoring. Today, many MSPs offer remote monitoring and management services

This evades the performance management and network-related issues from CIO's

head. Most of the banks outsource their network monitoring part, which gives

them maximum up time with performance.

Datacenters



Building a datacenter requires a significant IT budget and time to set up.

Plus there are other issues like choosing the right hardware vendor, power

requirements, cooling needs, etc. Therefore, today, organizations have the

option to have outsourced datacenter services rather than build their own. A few

months back we did a survey on datacenter and found that by and large 51% of

enterprises were running their own datacenters, while another 47% had either

completely outsourced it or were using a mix of both. So data center outsourcing

is a hot trend these days.

VPN networks



Managed VPN services follow the same trend as datacenters. Rather than

setting up your own infrastructure for VPN connectivity, an MSP can provide you

connection end-points while also managing it transparently. Before taking such

services the CIO should work on common SLA parameters including round-trip

times, the supported protocols (IP-MPLS, PPP, HDLC and ATM), security (IPSec),

redundancy, reporting and so on. Now with MPLS VPN, cost of incurring VPN

network has become affordable for enterprises. This solves the connectivity

issues that CIOs earlier used to have, while connecting remote and branch

offices with lease lines. Most telecom service providers today are providing

managed VPN services.

What to outsource and what not to?



It's a difficult call for a CIO while deciding what to outsource. Today,

almost all IT functions can be outsourced to an MSP. But before outsourcing, CIO

has to first evaluate organization IT infrastructure and segregate the IT

functions that he can outsource easily without affecting the business. Plus at

the same time CIOs also would like to keep control over all IT functions that

they are outsourcing.

In some cases critical business application and data can't be outsourced at

any cost. For example, in financial sector financial data is very critical, so

they can't afford to host applications and data server to an MSP premises, nor

would they want any vendor to manage it.

However, functions like networks and connectivity can be outsourced, because

they don't have other options. They have to tie-up with some MSP to connect

their branch offices. Security of data and application is another area that can

be outsourced because of limited skillsets available. Whatever's outsourced, a

considerable amount of time must be spent in finalizing the deal and defining

the SLAs.

Types of services models



There are various services models offered in this sector depending on the

client's requirements. Given below are the key services models used by MSPs

currently.

SLA-based model



The SLA-based model used by MSPs is one, where both client and vendor decide

and agree on certain deliverables. And based on the SLAs MSP provides services

to the client. If the MSP breaches any of these SLAs, the client penalizes the

MSP, according to the agreed norms. These are normally short-term contracts for

1 to 3 years, after that both parties can review the SLA contract for further

continuity.

Insourcing and co-sourcing of people



In the in-sourcing model, the MSP provides time and skilled IT manpower to

manage the IT infrastructure or other IT functions of an enterprise. The benefit

is that the enterprise would never have short-fall of skilled manpower, whereas

in the past, retaining manpower was a key challenge for an enterprise. However,

in co-sourcing both internal team and vendor work together to support IT.

Shared services model



This is a popular trend in managed services. You go for outside management

of your IT to decrease your operation expenditure. When an MSP creates a common

pool of resources for its customers and provides its services out of that pool,

the cost of operations for the enterprise goes down.



For instance, an MSP providing managed network or security services can create
an external NOC from where all the input data from the MSP's clientele can be

monitored at the same time. Several MSPs have created such NOCs for this

purpose. Similarly, applications and datacenter services also work well with the

shared model where several clients of an MSP have their servers and applications

hosted in a common datacenter (co-location) allowing for better manageability.

Dedicated service model



In the dedicated service model, the MSP can offer you services in two ways.

One, by hosting the applications into their datacenter and dedicate a complete

rack for you. Two, by providing you with dedicated skillsets and manpower to

manage your entire infrastructure which is inclusive of hardware and software.

Top reasons for outsourcing



1. The increasing need to provide consistency and quality of service to

internal and external users of the system.



2. Manpower retention for managing IT infrastructure is a problem



3. Multitude of technologies, platforms and applications being deployed in

the enterprise-the complexity of managing them.

Earlier, the costs used to be at the top of CIO's mind when deciding on

outsourcing IT management, but today it is the requirement of service quality

levels that bothers him most.

Future prospects



According to MSPs whom we have interacted with, only 30% of the organization

would like to go for managed services outsourcing, be it in any

form---networking, security or voice. And, data convergence outsourcing is the

next big wave for the coming years.