· Ensure that your CSP can send back-end orders to an acceptable port (from a security standpoint) on the merchant's corporate network. It's also important to find a CSP whose overall infrastructure approach echoes your own (see "E-Commerce Infrastructure," p. 44).

One of the biggest advantages of outsourcing your e-commerce effort is bandwidth savings, since many CSPs provide network redundancy at a much lower cost and quicker pace than most businesses working on their own. Many CSPs also have private peering arrangements with major Internet backbone providers and thus avoid the network congestion that exists at public peering locations. Some, like startup USinternetworking, have transit agreements that let them directly initiate trouble tickets on behalf of their customers.

Another significant advantage is round-the-clock monitoring of network traffic. CSPs and co-location providers that pursue such monitoring can easily detect and address common router looping problems impeding traffic flow from a particular backbone. Merchants with high-reliability needs say this feature alone can cost-justify outsourcing.

CSPs are also increasingly addressing performance concerns. About a dozen of the 64 companies responding to our services survey said they offer customer tools to measure packet delivery rates, and about half provide service-level agreements (SLAs).

Many also offer 30-day guarantees of satisfaction, which is one of the membership criteria mandated by the recently formed Web Host Guild (www.whg.org). Other criteria include 24x7 support, daily data backup, validation of bandwidth claims with backbone providers, and tests of help-desk competency through WHG inquiries. The goal is to raise the level of CSP competency by using WHG membership as a seal of approval. Sumo Inc., which operates a Web-based directory of hosting providers (www.webhostlist. com), founded and chairs the group, which had 33 members as of November 1998. Information about CSPs can also be found at www.tophosts.com and www.hostlist.com.

Merchants concerned about reliability and performance will also want to examine how a CSP runs its servers. For example, at least 36 of our 64 surveyed CSPs said they don't offer cross-server dynamic load balancing; 18 don't have server redundancy, 16 lack backup facilities and 11 lack network redundancy.

If security is important to you--and we think it should be--look for CSPs that not only offer perimeter firewalls, but also internal firewalls between applications. Credit-card information is best kept in a dedicated secure server--preferably one with limited access. A few CSPs also offer hardware accelerators to speed security processing, which is definitely a plus, but because of cost, this service is rather rare. We were interested to find only 15 companies offering e-mail virus scanning--even though 65 percent of e-commerce merchant companies experience viruses, compared to 50 percent of those companies without Web sales, according to a survey conducted by Network Computing's sister publication InformationWeek. We also found 11 companies identifying themselves as CSPs that don't offer basic digital certificate support (eight) or that declined to respond to a survey question about whether they have such an offering (three). Also ascertain whether encryption extends not only out to the buyer, but also from the server into the merchant network.

An important element for any business, too, is site promotion. If no one knows you exist, how will they buy from you? Many CSPs offer a wide range of site-promotion services. There is also an increasing movement to locate commerce sites at Internet portals like Yahoo! Netscape confirms that it, too, sees an opportunity. In November, Netscape told Network Computing that it is working on a "business transaction network" as well as planning to leverage its "Internet presence and software to offer hosting services."

Be prepared to spend a few days establishing payment-system support, typically through CyberCash, and digital-certificate support, typically through VeriSign. CSPs are trying to streamline this process, including working with financial organizations willing to risk taking on merchants without the more rigorous investigative processes now typically pursued.