SBA

Outsourcing IT

In a previous article I wrote about the difficulties of outsourcing management and administration of your IT systems and the need to build a relationship with your outsourcer. In this one I’ll try to cover some of the technical characteristics you should take into account.

SECURITY: First and foremost, if you outsource your IT you outsource access to your data. The outsourcer’s employees will potentially have full access to your network and servers, to your customer and sales data, your business strategy documents and trade secrets, possibly even to your payroll and what you earn. You need to know who, which individual employees, will have access, and what security screening they have had. You should expect the outsourcer to have process which records every access by his staff to your systems; - when, what, who, why and how, and that you should be able to both inspect those records and assure yourself that the process is not easily circumvented.

DOCUMENTATION: One day your relationship with your outsourcer will end - maybe you will move to another outsourcer or perhaps take the IT back in-house. When that time comes you will need comprehensive documentation covering the design of your network, configuration of servers, firewalls, databases, PCs, core applications etc., user IDs and administrator passwords, operating processes such as backups and updates, software licenses and so on. You will also need similar documentation for any outsourced services such as web hosting and email. It may be, especially if you work in a regulated business, that you also need this documentation for regulator and auditors. You don’t know when you will need it, so ensure that your outsourcer will create and maintain the large stack of documentation that goes alongside operating corporate IT from day one, and ask to see some documentation of other clients systems to assure yourself that the standard will be what you may need in the future.

EXPERTISE: You might have thought this would be the first item in the list, but no. The range of IT skills is incredibly broad, and no company can specialise in all types of systems, so you should ensure that the outsourcer is competent in your type of systems. Don’t expect a perfect match, you may be lucky but it’s more likely that you will select an outsourcer who knows most of what you need but has to learn some new stuff in order to take you on as a client. This is not a problem, IT skills are very transient and all technology suppliers and their staff are accustomed to learning new stuff all the time, but obviously a close match to your needs is preferable. Look for a commitment to professional development through employees membership of professional bodies for IT, Engineering, Project Management etc., and to technical development through evidence of product training and accreditations from major suppliers such as Microsoft, Oracle, Cisco, Red Hat et. al.

GEOGRAPHY: This should be obvious, but it’s not. Remote access technologies mean that your outsourcer will be able to do most of his work on your servers and PCs without visiting your premises, but nevertheless you will need feet on the ground from time to time to sort out networking and printer issues, to meet with you to discuss possible changes, and to work on any systems which are not accessible remotely (perhaps deliberately so to prevent intrusion).

WORKING HOURS: What happens when you’re beavering away at the weekend or late at night trying to get some crucial job finished when the IT goes wrong? Few of us in senior roles actually work 9 - 5 these days, and if we’re working we need our IT. Out of hours support may come at an extra charge but you want to know it’s there if you need it. An IT problem is one of the lamest excuses for non-delivery in business and signals incompetence to your clients.

REMOTE MONITORING: Most IT failures can be detected before they happen, there are usually pre-cursors which indicate to the skilled IT diagnostician that something is awry and enable them to fix it before a failure occurs. You should expect your IT provider to implement comprehensive remote monitoring of your systems and to react appropriately to pre-empt problems - very often before you or your staff are aware of any degradation in your IT systems. Ask the outsourcer to explain how they monitor your network, servers, anti-virus system, databases etc. and show you their “Network Operations Centre” where the monitoring information will be displayed and email alerts from your systems will be received.

SPARES: Sometimes hardware breaks, whilst IT equipment is very reliable it is also very complex and occasional failures are inevitable. Ask your outsourcer what spare equipment he holds, the last thing you want is a technician telling you that your thingummy-whatsit has died and it will take two days for a replacement to come. Spares should include PCs, printers, networking equipment and major components of these such as disk drives and monitors.

HELPDESK SYSTEM: No IT service provider is without one, a system to log and track the myriad little  problems and jobs that customers report - but they vary in quality and facilities. Ideally your outsourcer should provide a helpdesk system which allows you to log problems by Internet, and to view all your outstanding issues and their statuses - how long they have been outstanding and the progress the outsourcer is making on them. It is not unusual for jobs to get “lost” in helpdesk systems; it can be difficult for an outsourcer to keep track when there are hundreds of jobs in progress for their clients so you should also ask how your outsourcer reviews and prioritises the backlog of helpdesk jobs, and who gets notified when a job is in danger of breaching the agreed SLA (Service Level Agreement). You should come away feeling that keeping on top of the helpdesk jobs is a major priority for the outsourcer.

CHANGE: I mentioned the need to accommodate change in the previous article, but specifically you should understand how the outsourcer will assist you in changing your IT as your needs evolve and what it will cost. Find out whether the outsourcer has experience in supporting your type of business and business systems, whether they have learned about your industry from their work for similar clients and whether they will help you spot opportunities for IT that you might otherwise miss by not having your own in-house IT team. Understand what services to help you change will cost, and how the change to the outsourcing agreement and costs will change as your IT grows.

And finally…

HR ADVICE: Pardon? What’s HR got to do with IT outsourcing? Quite a lot really, the IT systems will be used by your staff, and what they’re permitted to do and not do, how they are protected when using your IT, and how they are equipped to use your IT all needs taking into consideration. A good IT outsourcer will be able to give you guidance on what IT policies you should have such as employee use of the Internet, use of social media, data protection, security and access control etc. Whilst they’re no substitute for HR professionals and lawyers your IT outsourcers should have a good idea about current best practice in the way that staff are permitted to use the corporate IT both to protect the company and themselves. Not least you should talk to them so that HR and IT policies are joined up.