££
Introduction
At the highest level the difference is clear – “on premise “means that the software resides within your data centre(s), whilst “hosted” means that it is located external to your infrastructure, and delivered as a service through the Cloud. However, beneath the surface there are a significant number of matters for consideration.
This Whitepaper presents the modern argument for hosting software through a SaaS provider, an option that in recent times has gained recognition for its flexibility and adaptability, or on-premise, which is typically understood to have better levels of security, ownership and control.
Licensing
With an on-premise solution, an organisation buys a perpetual right to use the software, but with a limited amount of support and maintenance. When this time period is up, they may continue to use the software and may wish to purchase additional support and maintenance coverage, which may, or may not, entitle you to software updates.
A hosted solution provides the right to access the software for a given period of time, but there is no transfer of rights within this. At the end of the period you may buy more usage rights, or, access to the service will be revoked. Usually, the hosted solution provides for a lower cost of ownership, as it is time limited.
For an on premise solution, an organisation buys the software upfront and pays for it at time of purchase, with supplementary annual recurring payments for support and maintenance. Generally these are around 15-25% of the purchase price and also linked to inflation to take into account the supplier’s increasing costs.
However, the software purchase price is only part of the cost to be incurred. Inherently linked to an on-premise purchase are infrastructure requirements with supporting software costs (for example, the hardware operating system, backup solution), installation costs (including staff time) as well as ongoing support staff costs, and possibly comms port costs.
It is important to bear in mind that the solution will support a business critical process and it is highly likely that you’ll need to consider a geographically separate Disaster Recovery solution, which will significantly increase the above costs. In addition, as you’ll be using the solution for a period of time, you will need to factor in hardware depreciation.
For the hosted method you are likely to pay annually in advance. There are no further costs that hang off of the hosted solution as the vendor deploys and manages the infrastructure, as well as providing the associated management processes (through the provision of a Planned Maintenance capability). The total cost of hosting can be significantly cheaper Software as a Service (SaaS) businesses are able to share the cost of expensive IT resource across its entire client base.
Updates and upgrades are an inherent part of any solution as any investment into software is likely to be long term. For hosted solutions, most, if not all vendors will have a planned maintenance schedule, which includes hardware and software elements. This allows the vendor to apply enhancements at both an infrastructure and software level, facilitating a timely mechanism for updates and upgrades. In addition, SaaS providers are very likely to be able to update software without the necessity of service downtime.
However for on premise solutions there are likely to be a number of obstacles to overcome. From a vendor perspective this is a labour intensive activity, as the on premise environment is likely to be different and will require additional testing over and above the testing already undertaken for the hosted version.
Once the on premise change is ready for deployment scheduling the maintenance activity will require increased co-ordination are more parties are involved , namely the vendor, on premise technology and end user teams , each of which will need to mobilise, deploy and validate the changes.
Planned Maintenance or Ease of Software Updates and Upgrades
When talking about end user support following a technical issue, irrespective of whether the issue arises on an on-premise or hosted solution, a detailed understanding of the issue will be required. This should include a description of the problem, the areas of the solution and users affected, steps to repeat the process (where relevant), system version number and screen shots (where applicable). This can often also be efficiently achieved via an online screen sharing session with one or more affected end users, the Service Delivery Manager and all relevant technical staff.
A hosted solution is the most effective method in this regard; support staff can access all elements of solution to triage, manage and resolve. This is likely to facilitate quick responses and resolutions. For an on-premise solution there are three support options. Firstly vendor support staff are provided with a mechanism to remotely access the system through firewalls and other secure mediums. If remote access is not possible then, providing information assurance requirements are met, the client will be required to provide remote access to any required database and system files. If none of these options are acceptable, staff will need to attend the site, gain access and diagnose the issue locally. This final option incurs cost, but mainly suffers from an element of delay into the resolution process; support staff will need to firstly be available for travel, and then undertake the actual journey before any kind of work can begin to resolve the issue.
The ability to add new functionality can also be a common problem in both on premise and hosted solutions.
In both cases an end-user organisation is required to pay for development but in an “on premise” model this is likely to incur extra maintenance costs and a potential re-write for every new software version. For hosted solutions the vendor is responsible for all system enhancements, upgrades and maintenance. Some can include customisation and typically, these will be handled as part of the subscription fee. It should be noted that not all vendors support customisations. It is then in the vendors hands whether to offer that customisation to its entire client base, either as a general enhancement or as an additional chargeable feature.
Customisation
One of the advantages of a hosted solution is the reduced need for reliance on the on premise technology teams. The SaaS vendor becomes responsible for system availability and reliability; for example patching and updates (during planned maintenance windows), data backup regimes, infrastructure and application resilience, as well as the provision and exercising of any failover capability.
An advantage with on premise solutions is that the client clearly retains ownership and control over their own data. With a hosted solution there needs to be clear understanding, prior to contract signature, about the parties’ various rights and obligations in the event of a dispute, as well as the vendors’ obligations to release the data upon contract termination.
Informational Access, Control and Administration
Accessibility
Whilst data security is of paramount importance for both on premise and hosted solutions, the potential reputational, financial and business impact of a data breach can often mean that SaaS providers invest more in digital security than in-house IT teams. There is often a perception on the part of the end user and Information Security Teams that the provider will not take as much care as an internal department; however the rising dominance of the SaaS model over the last ten years has resulted in providers leading the way in terms of security and redundancy. Ultimately, as a business whether you choose to host internally or externally, the SLAs for both options should be carefully considered.
In the either instance a series of controls should be present and these should be regularly tested.
About AIControlPoint
AIControlPoint deliver centrally located and remotely accessible incident and crisis management systems that replicate an organisation’s existing processes and ensure effective control over issues of all sizes.
Their software is used by a number of the worlds largest companies in a wide range of industries including Thomas Cook, Petrofac, Subsea7 and easyJet. They have also been named Gartner “Cool Vendor” for 2013 in Business Continuity Management and IT Disaster Recovery Management.
AIControlPoint is part of the Access Intelligence group, a collection of software modules which compliment the GRC life-cycle forcompanies worldwide, with a proven track record in delivering powerful solutions.
When considering this option, there are trade-offs to be made. Firstly, the increase in physical security and perceived value of ownership must be leveraged by overall costing, flexibility and ultimately a longer term look at what you expect from the product itself.
Quantification is evidently a key concern in choosing the best path, and loss aversion is typically the default choice; at first approach, owning software, maximising security and managing costs internally may seem to hold less risk. Or, it may at least appear to require less ongoing buy-in than a hosted solution which your company may well become dependent on.
A good resolution is to gain an objective viewpoint; to attach weighted values to each attribute, then use these to demonstrate which path is better in the longer term rather than allowing preconceptions to reduce your options.
