A CIO can neither be pro- nor anti-outsourcing. Instead, he or she must ensure the outsourcing option is a tool upon which to call as the appropriate situation arises. Take two of the biggest issues facing IT departments today: Cloud computing and mobile device management, or bring-your own computing. Interestingly enough, the biggest concern with both of these issues is that of data security.
Cloud computing is a manner of outsourcing already; the questions that need to be answered regarding moving to the Cloud are the same as those for any outsourcing decision. Mobile device management (MDM) is a real candidate for outsourcing in the near future. It’s similar to what many companies do today with their car fleet.
Soon, providers will offer the MDM service, where staff members register the devices they intend to use for work and the MDM agent manages the security polices, data protection, desktop virtualisation, vulnerability testing, remote disablement and software maintenance — your approved OS, anti-virus, encryption and discover agents — for all of the approved mobile platforms. They will be able to provide the expertise and the economy of scale while you pay for the service and not the headaches.
The key is not to start with the ‘what’ and ‘when’ questions. Instead, start with ‘why’ — why do we want to outsource any of the services we are providing to the business? The answer is not often articulated and documented. It is like starting a major project without a business case or requirements.
Be sure to document why you are considering outsourcing services. Reasons may include cost, internal provision issues, commoditisation or the need to reduce staff. Whatever your reason to outsource, set measurable goals that can effectively gauge its efficacy.
What to outsource?
Once you have clear objectives, you can consider outsourcing candidates. One place to start is the ‘IT service catalogue’. Which of these services best fits the characteristics you wish to achieve? It may be as simple as a service request for issuing computing devices to new employees. The more valuable services to outsource are typically the supporting IT services that have become commoditised. You can then up-skill your own staff into more interesting and valuable roles.
What not to outsource?
There are a couple of simple rules. Don’t outsource customer facing services, including your service desk. Your unique value to the business is your understanding of its situation. The business can gain much by sharing its strategy and IT loses a lot if it is out of this loop.
Don’t outsource services that you have not fully documented. If you understand how you are delivering a service, you can work with the outsourcer to make improvement. You do not want to blindly accept their way of doing things as you forego your value statement by not applying the business perspective.
Don’t outsource services that are not under control.
Outsourcing an unstable service will not make your problems go away — it will multiply them with the issue of demarcation and penalties. If the service is not cost-justified due to its instability, fix it internally, or close the service down.
When to outsource?
Outsource when you fully understand the service, it is routine and repeatable, and it is fully documented. The movement to an outsourcer should be seamless to the business.
The questions of ‘who’, ‘where’ and ‘how’ are unique to each organisation and each candidate service.
Asking ‘why’, ‘what’ and ‘when’ sets up your strategy for outsourcing based on your objectives and it identifies what modifications, if any, are required before you can outsource a service for the right reasons.
Ask yourself: Why do we want to move to Cloud computing? What will we move and when will we move it? Do we understand how mobile devices are managed within the organisation? You cannot move to outsourcing until you do so.