Managed Telecom Services Deliver Business Continuity Automatically

You never know when an unexpected turn of events is going to keep you out of your office. You may not live in earthquake country, or a hurricane zone, or a tornado corridor, but that doesn't exempt you. Everything from fires to broken water mains to police actions can unexpectedly mean that you're suddenly not able to do business where you thought you would that day.

Acquirent, an outsourced sales execution firm based in Evanston, Illinois, knows this all too well. When its eleven employees were told to evacuate the premises unexpectedly one day, they had no choice but to pack up and go. But the disruption was surprisingly minimal.

Built-In Business Continuity
Because Acquirent offers outsourced sales services, founder and CEO Pete Kadens had a high level of confidence in choosing an outsourced phone system. He had deployed Geckotech's hosted IP phone system, which meant that his telecommunications capabilities weren't even inside the affected location.

"We all just packed up our files, laptops and Cisco phones and went home," says Pete Kadens. "Everyone plugged in their office phones at home to their DSL or cable and the office was back up and running with no disruption of our business. Even during the drive home incoming calls were automatically redirected to our cell phones. Without Geckotech VoIP, I don't know what we would've done."

Managed Services Bring More Flexibility
Managed telecom services provide a great deal of flexibility for companies who don't want to own their own phone system, both in terms of adding people and avoiding capital expenditures. And VoIP systems bring added benefits in terms of integrated electronic in-boxes and easier collaboration between colleagues.

But they also bring an added measure of protection in the event of a disaster. If you have a small or midsized business, take a moment to think about how you would continue to communicate among colleagues and clients if you were unable to work from your office, and consider the value of managed telecom services in that situation.

Perhaps you've already considered a managed network services solution to reduce your operational costs, or free-up your valuable time to reinvest in your core business. Now you can add one more benefit to the list – have a game plan for the unexpected interruption to your business communication capabilities.

Read more »

Managed Service Enables Secure Delivery of Intellectual Property

In a global economy, professional services firms must differentiate themselves from their competition in increasingly creative ways. Rockwell Technology Group, a Grand Rapids, Mich.-based software development firm, serves customers across the U.S. Midwest and Canada, including manufacturers, insurance companies, and management services.

Because its customers are widespread, it needed to come up with a way to quickly and securely deliver software updates and patches for systems it had developed. As a way to save both time and money, it uses WebEx Workspace, a hosted extranet service, to post the results of its work for download by customers.

The alternative would be to burn the software onto a CD or DVD and either have it delivered by hand or shipped overnight. But by using WebEx Workspace, Rockwell garners several advantages.

Saving Time, Increasing Security
One advantage is that the software updates, which may be necessary to make a business process more efficient, are immediately available to customers. "As soon as our developers have new custom software ready for delivery, I can call the customer and say, 'download it and you're good to go,'" says Mark Laws, Rockwell Technology Group's chief operating officer. Rockwell doesn't have to send someone to the customer to install the software.

Rockwell's customers also appreciate the increased security. WebEx Workspace uses the Secure Sockets Layer (SSL) protocol to ensure protection during transmission, and Rockwell posts software updates in a password-protected folder accessible only to that customer.

Hosted Collaboration Brings Internal Advantages
Rockwell also uses the collaborative workspace internally as well, which helps the company update team members about customer projects.

It stores project-related documents in the hosted Document Manager; it uses the Discussion Forums to carry on impromptu online chats, which are then maintained for later access by other team members; and it maintains schedules and to-do lists using other Workspace capabilities.

Even though Rockwell could just as easily deploy collaborative software internally, it prefers to use WebEx Workspace because of its capacity and convenience. "We have millions of gigabytes stored on the WebEx Workspace," says Laws. "If one of our computers crashes, we don't have to worry about losing any data. We just go to another computer."

If you need to share sensitive information securely, and don't want to worry about maintaining an extensive infrastructure, asking a managed services provider to set up a collaborative workspace can help you focus on serving your customers more productively.

Read more »

Eight Options for Managed Security Services

In the online network connected business environment, security is more critical -- and also more complex. Today, network security requires constant monitoring and management. All businesses now experience vulnerability on an infrastructure that often extends to many locations.

Managed service providers can create a comprehensive security offering that enables you to maintain the level of protection and control you require. They can manage some or all of your network security functions -- giving you access to their dedicated manpower, 24-hour safeguarding, as well as routine maintenance and management of disaster recovery.

Finding the right security solution for your organization begins with establishing your priorities and becoming informed about alternatives. The following describes typical managed security service offerings, and how you can apply them.

Managed Firewall
Firewalls protect internal and external networks by restricting the types of network protocols and traffic allowed on your network. Firewall appliances, which the service provider manages remotely, include dedicated hardware and software platforms located on your premises.

Managed Distributed Denial-of-Service Protection
This service involves protecting the network infrastructure and network-based resources from distributed denial-of-service (DDoS) attacks -- so that your business can operate without interruption. It also helps prevent worm propagation that can cause DDoS attacks. DDoS mitigation provides protection against emerging threats.

Managed Intrusion Prevention Systems
Intrusion prevention systems (IPSs) identify and stop inappropriate attempts to access your network, systems, services, applications, or data. Intrusion detection services (IDSs) rely on network-based or host-based monitors, and often match monitored traffic or activity against profiles of known attacks.

Managed Antivirus Protection
This service most often involves checking for viruses at the gateway or firewall as well as in your e-mail messages, attachments, and file transfers. The service often includes automatic updates to antivirus definition files.

Managed Endpoint Protection
This service detects and stops unusual behavior on your endpoint devices, such as desktops and servers. In this way, you can prevent damage from Day-Zero security threats whose signature has not yet been identified.

Managed Authentication
Authentication refers to a group of processes and technologies used to verify the identity of a user attempting to gain access to your systems or applications.

Managed Content Filtering
Filtering is used to isolate and block content deemed inappropriate according to your internal policies or regulatory policies.

Vulnerability Assessment
The service includes security risk assessments, network scanning, and probing to reveal vulnerabilities in your network, operating system, or applications that can be accessed from the public Internet.

Contact a managed service provider, to learn more about these security capabilities, and the associated cost savings or productivity benefits. Most providers will have customer case studies for your consideration.

Read more »

Managed Security with a Strategic Twist

Managed services provider Verizon Business has added an interesting twist to its security toolbox. Traditionally, managed security services are tactical: they monitor a network for potential attacks, using virus signatures and other definitions.

Earlier this month, Verizon upgraded its customers' security capabilities with what it calls its "Risk-Correlation Service," designed to add strategic insight to security.

The RCS works with vulnerability scans -- either those it does for customers or those from vendors such as McAfee, Qualys, and others -- to determine where potential vulnerabilities exist. The service also documents your system to create a map of devices and the business processes that run on them. "It marries threat information with vulnerability information," says Jonathan Nguyen-Duy, Director of Product Management for Verizon.

Calculating Risks
The result is a Web-based scorecard that shows Verizon customers not only where potential problems exist, but rank the level of relative importance of those devices. "We can tell you the likelihood of an event on a particular device, but also the business process associated with that device," says Nguyen-Duy. "Using the information from the vulnerability scan, we can tell you about the impact on availability. Is the device running real-time transactions, or is it a database server that might have less sensitive information?"

Strategically, companies can use the information presented in the online scorecard to get a sense of where to improve their online protection. Not all information is created equal, and not every database server requires the same level of protection.

The scorecard is designed to help companies prioritize their security budgets and their business continuity programs. "With limited resources, it's important to understand the relative risk of each vulnerability," he says.

Protection from Attacks
The online scorecard also works when attacks are underway. In those instances, it helps customers work with Verizon to identify where remediation is most important. "Sometimes you have to work in real-time to figure out where attacks are happening," Nguyen-Duy says. "Your ability to respond is improved when you have better information on the threat and what business process might be affected."

Being proactive about security is like flossing your teeth; you know you should do it more often, but it doesn't always happen. Applying a methodology that combines both strategic and tactical security needs is very wise. Clearly, when it comes to security, it's easier to be reactive when you've already been proactive.

Besides, the complexity of providing comprehensive network security protection, and keeping it fully up to date, is something best left to the experts. That's why managed security is one of the most utilized managed service offerings.

Read more »

Six Options for Managed IP Communications

Many traditional businesses maintain separate networks for data and voice communication. With a converged voice-and-data network, companies can often reduce costs and gain significant productivity benefits.

However, the cost of implementing and managing the solution internally can be prohibitive. A more affordable option is to out-task IP communications to a managed services provider. This arrangement avoids initial CapEx and provides economies of scale -- because the service provider already owns the required infrastructure.

You can choose from several options for managed IP communications services. The following describes typical managed IP communications service offerings, and how you can apply them.

Business IP Telephony Services
This includes both subscriber and group calling services. Companies that need sophisticated PBX features can use a managed IP telephony service. Many small businesses can also receive the functionality that they require with a managed IP telephony solution.

Site-to-Site Voice
This service is really useful for companies with several branch offices that communicate regularly. A site-to-site voice service enables you to call from one site to another using the service provider's voice-over-IP (VoIP) infrastructure, avoiding long-distance toll costs. You can maintain a private dial plan, including support for simple 4-digit dialing.

Public Switched Telephone Network Access
Access to the traditional public switched telephone network (PSTN) can be enabled centrally over the service provider's network. Central PSTN access provides economies of scale, which, in turn, help reduce your costs.

Unified Messaging
These capabilities enable you to retrieve and respond to voice, fax, and e-mail messages from any phone or PC within your organization. Your team can check any type of message from the same inbox -- either the voicemail box, accessed from a phone, or the e-mail inbox, accessed from a computer. Rules-based call routing and speech recognition can further enhance usage for you, and your callers.

Voice over VPN
This service can reduce toll charges for your telecommuters and mobile team members. Using an IP phone from home, or SoftPhone software on your laptop during travel, you can easily make voice calls over the same, secure Virtual Private Network connection that's used to access data network applications.

Other Enhanced Services
You can also increase productivity by delivering new applications and information directly to your team's IP phones. As part of a managed IP telephony service, providers can provide customized Extensible Markup Language (XML) applications -- for example, to access team calendar information or read news stories relevant to your business.

Contact a managed service provider, to learn more about these IP communication capabilities, and the associated cost savings or productivity benefits. Most providers will have customer case studies for your consideration.

Read more »

Can Managed Services Rescue Financial Services?

Turmoil and struggles in the financial services sector are splashed daily on the front page of newspapers around the world. The industry faces a number of monumental challenges that are threatening and shaping its future. To remain competitive, forward-looking firms need to:

• Reduce costs
• Improve cross-sell and up-sell results from existing customers
• Shift capital expenditures to operational expenditures through variable costing and on-demand capabilities
  

Progressive companies in the financial services sector are aggressively using managed services technology to address some of these current challenges.

Serving Market Growth
The financial services sector currently spends more than 2.5 times more on technology than other industries. The way they can attack challenge number one is to shift the management of desktops, data centers, and call centers to a managed services model. Companies are using this option not just to reduce costs, but as a way to reallocate investment into growth initiatives.

One regional U.S. bank came to Cisco ISBG (the company's strategic consulting arm), wanting to quickly enter a new niche market faster than a competitor and increase its market share. Its tactic: deploy an end-to-end managed service, including both technology and business processes.

The economics of managed services lower the barriers of entry to niche markets that might not have been economical before; it also helps them determine success or failure more quickly, and act accordingly.

Managed Services Increase Customer Ties
In developing markets, companies are looking to use managed services to target customers who might not have used banks at all previously. A managed service that offers the underlying network infrastructure, including phones, provides them with an on-demand and scalable service that they can roll-out ahead of competitors.

To increase the amount of business conducted with customers, financial services firms are looking beyond the traditional world of financial transactions and services. One large bank we're working with wants to expand its relationship with its small and mid-size customers by providing them with essential services as payroll, procurement, and human resources.

Because the bank wants to roll out these services quickly, they will be created, delivered and managed by another entity through a managed services model.

Next generation managed services offer a real opportunity to transform the financial services sector. But success will require creative thinking, as well as both the development of strategic partnerships with managed services providers and proper governance models.

About the author: Stuart Taylor is a Director in Cisco IBSG. Stuart leads thought leadership and engagements with key Service Providers in managed services. He has over 15 years of experience focused on strategy, corporate development, business unit strategy, M&A and operational improvement with large mobile and wireline operators and high technology clients.

Read more »

IP Virtual Private Network Service Options

Service providers offer a variety of options for managed services. The following describes the first of the top three most popular managed services, and the associated options, to help you determine which services would be most useful for your company.

Businesses gain both tactical and strategic advantages when adopting IP Virtual Private Networks (VPN). In the short term, they benefit from cost-effective, secure network connectivity to branch offices and secure access to remote workers, teleworkers, and global partners.

In the long term, they position themselves to take advantage of new value-added, IP-based applications and to support more users and applications at a lower cost.

Choosing a Best-Fit IP VPN Solution
Cisco commissioned the Yankee Group to describe the decision-making process that enterprises used to select one of three broad types of IP VPN managed services (click on image to enlarge).


You can use the decision tree to determine which of the three options for managed IP VPNs is most appropriate for your company:

• Network-based IP VPNs – Service provider provides complete management services.
• Managed CPE-based IP VPNs – Service provider installs and manages the equipment on the customer premises and provides connectivity.
• Do-it-yourself IP VPNs – Business installs and manages the equipment; service provider provides connectivity.

Read more »

Retailers Upbeat About TelePresence Applications

Companies with extended supply chains frequently need to collaborate with multiple partners -- simultaneously and visually. Yesterday at the National Retail Federation Conference in New York, AT&T and Cisco reminded attendees that they have added multipoint capabilities to their telepresence offering, which AT&T delivers as a managed service.

Attendees visiting AT&T's booth participated in videoconferencing discussions with Cisco employees in San Jose, and expressed confidence that they could apply the teleconferencing capabilities in their business immediately. Collin Cupid of high-end handbags and accessories manufacturer Coach said, "It made you feel like everybody's in the same room."

Sally Curtis of Planet Retail, a market research firm, said, "We can use this in our own context for communicating with customers. It's absolutely real." A couple of executives from United Rentals wanted an installation "yesterday," but were willing to settle for getting the equipment from the show floor. "Can we take that one right now?" asked Michael Ellis.

According to the companies, the AT&T Telepresence Solution works over the AT&T Virtual Private Network transport and provides:

• AT&T-owned Cisco TelePresence equipment
• Visual experience with the simplicity of a phone call
• Installation, monitoring and management of the application
• On-site equipment maintenance and repair, plus remote support
  
• Ability to handle complex, multinational, inter-company communications
• Security and reliability, as well as reduced IT staff requirements and limited impact on existing network applications
• Reduced exposure to technological obsolescence, reduced upfront capital expenditure
  

Global companies with extended supply chains can use telepresence to improve communications and accelerate time-to-market. They can also apply the visual medium to transcend cross-cultural communication hurdles, and thereby improve the speed of decision-making and overall operational efficiency.

Read more »

AT&T Telepresence Gets Retailers Talking

AT&T demonstrated its telepresence capabilities at this week's National Retail Federation conference in New York City. Retailers and other attendees are already talking about how the global industry could use Business Video technology to improve supplier and customer relationships, reduce travel expenses, and make supply chains more efficient.

Using Cisco's TelePresence technology for videoconferencing, AT&T offered attendees the chance to participate in sessions with Cisco employees in San Jose. Chris Eubanks of athletic equipment retailer Sports Authority said, "It was one of the most real things I'd ever seen. It was like being in the same room as the people in San Jose." Carlo Pochinesta of clothing manufacturer Gucci said, "It was as close to meeting in person as you can get and yet not be in the same room together."

As a salesperson, Erik Kostelnik of employment Web site careerbuilder.com found it helpful in his work. "I started reading the body language of the people. I'm in sales, so it's real important that to understand who I'm talking to and how they're responding to my questions."

Telepresence for Training and Improved Customer Experience
In addition, AT&T and Cisco announced that several retailers were already using AT&T's telepresence solutions. Office products retailer Staples is using it for corporate training, while Cabela's, one of the leading retailers of outdoor equipment is using it to improve the customer in-store experience.

Cisco's TelePresence solutions are part of its Connected Retail strategy to help retailers collaborate better with suppliers, partners and internal staff, while lowering operating costs.

Based on the reactions in the above interviews, telepresence is on its way to becoming a clear alternative to air travel for companies with a global presence. They can benefit from maintaining face-to-face discussions and relationships, while still avoiding the time and expense required for on-site visits.

Watch another video to learn more about the fully managed AT&T Telepresence solution.

Read more »

Managed Services Enabled Strategic Focus of IT Resources, Part II

As noted in Part I, global sensor manufacturer Measurement Specialties Inc. (MSI) faced multiple challenges with its managed network services provider. It suffered from excessive downtime, and the team of IS/IT director Bob Andreini spent too much time solving problems that were the responsibilities of their provider.

Andreini brought in Virtela, a Greenwood Village, Colo.-based managed network services provider that works with multiple vendors of networking equipment, including Cisco. It devised a mesh network using Multi-Protocol Label Switching (MPLS) technology that eliminated the point-to-point problems that plagued MSI previously.

He describes it as a seamless network with multiple subnetworks, "almost like a black box. Someone in Fremont, Calif., can send something to our site in Shenzen, China via the most logical route over the network."

Automatic Backup
At the same time, MSI's downtime has disappeared. Virtela set up a back-up DSL circuit at each of MSI's sites, so that if anything does go wrong, the back-ups kick in automatically. "We can't even tell when it happens," says Andreini. "Usually we only find out after we get notification from Virtela's operations center." The cost of the DSL lines is only a couple hundred dollars a month, and he estimates that MSI now enjoys more than 99% reliability.

Even with his difficult experience, Andreini was still sold on outsourcing his network services. "I didn't want to beef up on network engineers internally, because that technology is so complex. Having a partner that could take care of that was very attractive."

Dramatic Time Savings
Having a managed network services provider also gives Andreini "dramatic time savings. When every event took two days of firefighting, we were unproductive in other projects. It was very disruptive, and took the equivalent of at least two full-time people. Having a managed network services provider means I can have my staff focus on the strategic IT needs of the business, not running the infrastructure."

The moral of the story is that it's important to look closely at your managed services provider. Don't look just at their services, but at their business model and their telecom relationships. Determine how their plans suit your company, and your plans for your company's growth. As MSI found, it was able to shift from an unsatisfactory provider to a satisfactory one and reap the benefit of reliability.

Read more »

Managed Service Nightmare - Lessons Learned, Part I

By any measure, Bob Andreini's network was a nightmare. Even though he had outsourced the management of the network, downtime was measured in days. His team regularly mediated finger-pointing between international telecom providers. Even the configuration of his infrastructure left a lot to be desired.

Andreini, the global director of IS and IT at Measurement Specialties Inc., a $200 million manufacturer of sensors with 12 locations around the world, knew something had to change.

His company had grown through acquisition, adding sites in locations in Galway, Ireland; Versailles, France; Dortmund, Germany; and Bevaix, Switzerland, a village of 3,500 outside of Neuchatel. But this growth also meant an increasing patchwork of network connections.

Reliability was a challenge, especially with an IT staff of 35 and only ten of those people devoted to the infrastructure -- able to work only part-time on this key task.

Downtime Here Meant Downtime There
A hub-and-spoke infrastructure meant that all communications went through MSI's corporate headquarters in Hampton, Va., some by point-to-point connections, others through VPNs. "If we had trouble in Hampton, we had trouble across the whole network," says Andreini.

Part of the problem, he admits, came from the telecom provider's own growth problems. It didn't always have the best relationship with telecommunications providers in the countries where MSI did business.

"We ended up with higher communications costs, because they couldn't get good resell rates." And because it didn't have good relationships, where there were problems, there was a lot of finger-pointing. "We would eventually have to have our IT people figure out the problem," sighs Andreini. Then the guilty party would admit it was their problem, sometimes as much as two days later.

Unmanaged Services
Some of Andreini's team even had to spend time learning about Cisco router configurations because their provider, which was supposed to be providing maintenance, had outsourced it to yet another company.

Solving MSI's network management problems took multiple steps, including signing on with another vendor of managed network services. MSI worked with the new company, Virtela, a Greenwood Village, Colo.-based company, and its team to create a new infrastructure. Together they took a close look at what kind of infrastructure would serve the global firm best.

In part II: how MSI solved its managed service problems.

Read more »

Managed Service Enables Secure Delivery of Intellectual Property

In a global economy, professional services firms must differentiate themselves from their competition in increasingly creative ways. Rockwell Technology Group, a Grand Rapids, Mich.-based software development firm, serves customers across the U.S. Midwest and Canada, including manufacturers, insurance companies, and management services.

Because its customers are widespread, it needed to come up with a way to quickly and securely deliver software updates and patches for systems it had developed. As a way to save both time and money, it uses WebEx Workspace, a hosted extranet service, to post the results of its work for download by customers.

The alternative would be to burn the software onto a CD or DVD and either have it delivered by hand or shipped overnight. But by using WebEx Workspace, Rockwell garners several advantages.

Saving Time, Increasing Security
One advantage is that the software updates, which may be necessary to make a business process more efficient, are immediately available to customers. "As soon as our developers have new custom software ready for delivery, I can call the customer and say, 'download it and you're good to go," says Mark Laws, Rockwell Technology Group's chief operating officer. Rockwell doesn't have to send someone to the customer to install the software.

Rockwell's customers also appreciate the increased security. WebEx Workspace uses the Secure Sockets Layer (SSL) protocol to ensure protection during transmission, and Rockwell posts software updates in a password-protected folder accessible only to that customer.

Hosted Collaboration Brings Internal Advantages
Rockwell also uses the collaborative workspace internally as well, which helps the company update team members about customer projects.

It stores project-related documents in the hosted Document Manager; it uses the Discussion Forums to carry on impromptu online chats, which are then maintained for later access by other team members; and it maintains schedules and to-do lists using other Workspace capabilities.

Even though Rockwell could just as easily deploy collaborative software internally, it prefers to use WebEx Workspace because of its capacity and convenience. "We have millions of gigabytes stored on the WebEx Workspace," says Laws. "If one of our computers crashes, we don't have to worry about losing any data. We just go to another computer."

If you need to share sensitive information securely, and don’t want to worry about maintaining an extensive infrastructure, asking a managed services provider to set up a collaborative workspace can help you focus on serving your customers more productively.

Read more »

Unified Communications Helps Law Firm Serve Clients

A professional education trains someone to be a lawyer, doctor, or accountant, but it rarely teaches them how to run a business practice – that's typically learned from experience. Ken Wolfe is a worker's compensation lawyer in Chicago with 25 years experience.

When he hung out his own shingle, he realized that in addition to being a lawyer, he was now managing his own business operations.

Among other things, that meant making decisions about choosing the best telephone system for his business needs. Wolfe thought he was playing it safe by setting up his operation with phone and Internet service from a leading telecommunications provider, using traditional technology.

But before long, he realized he missed many of the services that had been available at his previous firm, which had used Geckotech's hosted IP-based phone system. Lesson learned, he switched providers after a year.

Hosted System Brings Voice and Data Together
Because the replacement phone system was hosted, Wolfe no longer had to worry about leasing, managing, or maintaining the phone system. Because it was IP-based, his firm was able to take advantage of capabilities that integrated voice and data together.

For instance, his employees could easily forward calls to a different number, such as a home phone or cell phone if they expected an important call from a client – they could also route less crucial calls to voice mail if they arrived after hours.

Because Geckotech offers a variety of reports regarding phone services, Wolfe Law could track length of calls by client, which made professional services billing simpler. It could also track outbound calls by employee, inbound calls, and call length, among other metrics. It was also easy to add new employees to the system, simply by plugging in a new IP phone.

Increased Productivity, More Control
Wolfe Law also benefits from Geckotech's 24-hour support from a local help desk, a dependable monthly bill from one service provider, and built in disaster-recovery.

As Wolfe says, "In my practice, phone calls are extremely important, but they also can be the bane of my existence. Geckotech helps me keep them manageable and under control. I cannot imagine running my practice without it."

When it comes to telephone service, bigger is not always better. Sometimes smaller firms using IP-based hosted services, like Geckotech, can offer more creative ways to help businesses to not only track their communications expense, but gain valuable business insight from that data. Think about what kind of data you might be able to glean from your telecommunications system.

Read more »

When Selecting a Qualified MSP, Assume Nothing

Hiring a managed services provider shouldn't be a leap-of-faith decision-making process. Perhaps you have staff that could fulfill their responsibilities, but instead you entrust a key component of your IT infrastructure to another company.

You believe they can do the job better and more efficiently. However, is that belief proven to be justified?

This begs another question: who licenses or certifies a managed service provider?

The topic came onto our radar thanks to a handful of companies claiming SAS 70 certification. The SAS 70 standard was developed by the American Institute of Certified Public Accountants (AICPA) to govern service organizations. (SAS stands for statement of auditing standards; see the AICPA page relating to auditing standards for more information.)

Certification's Real Meaning
You may assume that a managed service provider claiming SAS 70 certification has submitted itself to rigorous tests relating to its internal processes. However, according to Judith Sherinsky, technical manager of audit and attest standards at the AICPA: "There is no such thing as SAS 70 certification."

Sherinsky says that undergoing a SAS 70 audit only results in what she calls a "restricted use report," one intended to help auditors at the customer determine the reliability of transaction processing at the managed service provider.

For such a report to be useful to a customer, it must have meaningful context. "If the service provider organization provides several services, the report is useless if it doesn't cover the services the customer is interested in," she says.

Let's be clear: any MSP willing to undergo an audit is good for the industry, and helpful for the buyer. I'm merely highlighting the need for due diligence.

We'll return to this topic, both to keep you updated on what we learn about other standards and certifications (for instance, the ISO/IEC 20000 standard for service providers, and the MSPAlliance Accreditation program).

Attestation vs. Certification
In fact, Sherinsky suggests that customers of managed service providers check out the AICPA's attestation standards. These encompass a review of engagements that are the responsibility of "another party," that is, a service provider. An attestation report covers the processes between two parties, while an SAS 70 report covers processes internal to a service provider.

When your service provider claims certification under certain standards, don't take them at face value. Ask them exactly what it means, and how it's relevant to your relationship.

Any "seal of approval" is only of value in the procurement process when you have a sense of how stringent the benchmark requirements are, and whether they apply to your specific needs.

Read more »