Review: Outsourced Data Center Services

Sure, big outsourcers brag about the height of their racks, the amount of room under their floors, their monster KVA generators and multiple redundant WAN connections. All cool stuff. But at least as important is the right mix of service and price for your company. We decided to check the state of this balancing act for smaller companies by sending out an RFI on behalf of our fictional widget manufacturer, NWC Inc., which is seeking a partner to manage its server infrastructure (click over to inc.gb.nwc.com to order a widget, and see our scenario on page 42 for a list of requirements).

We sent our RFI to 18 outsourcing companies. EDS, Globix, Infosys Technologies and Savvis agreed to participate. Rackspace and Infocrossing initially accepted, but backed out when they learned we require--and publish--pricing reflecting our scenario. Our invitation to Sun Microsystems was inadvertently delayed, and by the time the company could respond, it was too late to include it. We regret this misstep--Sun is a force in the outsourcing arena, and NWC Inc. would have liked to consider it. Affiliated Computer Services (ACS), AT&T, Hewlett-Packard, IBM Global Services, MCI, Perot Systems, Sterling Network Services, Tata Consultancy Services, Unisys, Verio and Verizon didn't respond to our invitation. Patni Computer Systems and Cognizant didn't fit our criteria.

NWC Inc.'s servers, load balancers and network connections support the customer-facing and back-end apps used to manufacture, sell and deliver widgets. We judged responses based on service levels, including availability and MTTR (mean time to repair); price, both monthly and start-up; support; provided hardware, software and storage systems; and network and environmental factors. NWC Inc. runs 24/7 on a diverse infrastructure, including Apache, IBM WebSphere, Oracle, SQL Server applications, and an internally developed stock-management app running on Red Hat Linux and Windows 2000. We maintain 6 TB of data and would like to outsource WAN provisioning, network and systems support, and maintenance, but not at the expense of flexibility, availability and stability.The question of what size outsourcer would be the best fit for a small company like NWC Inc. doesn't have a one-size-fits-all answer. EDS' size is a concern--NWC Inc. would be a small fish in its big pond. But EDS' response assured us the company would value our business. Globix included a frank discussion of having been in bankruptcy. We like partners that face potential problems head on, and though we'd need further due diligence to feel comfortable with a long-term relationship, we appreciate Globix's candor. Only Infosys' response left us somewhat cold. The company presented itself as large and organized, but a lack of detail in its response cast doubt on its ability to execute. We realize vendors may not want to spend significant time on an RFI for a fictitious company, but we did explain that scoring would be based solely on information provided, and other vendors provided more.

Guaranteed service levels around network throughput and system availability accounted for 25 percent of our scoring. EDS, Savvis and Globix all offered good network throughput guarantees. EDS and Savvis provided 100 percent guarantees for network throughput; EDS would provide 2 Mbps throughput, burstable to 10 Mbps, while Savvis offered 1 Mbps with incremental charges for bursts. Globix promised 120 ms RTT (round-trip time) on its backbone, delivering site-to-site connectivity between our Syracuse, N.Y., and Green Bay, Wis., locations over a VPN, while EDS and Savvis have dedicated connections. Infosys offered only a connection to its Boston PoP, from which NWC Inc. would need to provision separate WAN links to Syracuse and Green Bay. No thanks.

Savvis and EDS included high-availability servers in their proposals, with EDS guaranteeing 100 percent uptime versus Savvis' 99.9 percent. That .1 percent difference translates to more than eight hours of downtime per year. Globix didn't offer a guarantee but pointed to its careful server performance monitoring. Infosys outlined a methodology of how a good SLA (service-level agreement) could be determined and explained that after a baseline period it would negotiate with NWC Inc. for an acceptable level--a logical metered response that falls short compared with the Savvis and EDS guarantees.

All the vendors defined problem severity in terms of service interruption. This makes sense. Infosys and Globix claimed response times as low as 15 minutes but allowed those times to rise as problem severity decreased. EDS had a flat 15-minute response regardless of severity. Savvis identified an escalation procedure that allowed Level 1 support 30 minutes to fix a problem before escalating to Level 2. Level 2 gets two hours before engineering and Savvis management are alerted. We like EDS' definitive response time and Savvis' clear parameters, but all responses outlined acceptable procedures.

Sticker Shock

Outsourcers, and other tech companies whose products we review, regularly raise a fuss over making their list pricing public--vendors don't want to give away their margins to competitors or customers. We understand. But we've never met a product manager worth his or her salt who didn't have a good idea of the competition's pricing structure, and IT professionals expect to negotiate. We tip our hat to those vendors willing to expose their pricing (see "Price Comparison" chart).

EDS' service was by far the most expensive for both one-time and recurring charges. A significant line item was the purchase of Sun hardware at $140,000. Infosys responded with a range from $16,000 to $22,500, which didn't include any server hardware; the vendor expected NWC Inc. to ship its current hardware.

EDS quoted a 36-month price; Globix, 24 months. Savvis broke out one-, two- and three-year figures. For comparison, we summed up Infosys' collocation-only and managed-service pricing, both quoted as month-to-month without a defined term. Monthly recurring charges for Infosys were $22,500; Savvis, just over $48,000; Globix, $54,000; and EDS, $70,000.Support Lines

We attempted to gauge the level of support NWC Inc. could expect by evaluating tech expertise, account-management structure and the management tools offered. We measured technical expertise by comparing the range of application and vertical industry support as well as industry certifications each outsourcer has.

All four vendors have the OS expertise NWC Inc. needs, but EDS and Savvisoffered wide-ranging vertical industry support, with expertise in finance, retail, e-commerce and government. Savvis added the key vertical of media and entertainment. Globix listed a respectable number of supported apps, including Apache, BEA Systems, WebLogic, IBM WebSphere and Oracle. Infosys listed generic areas of expertise--NWC Inc. would have to find out whether Infosys could manage our app infrastructure.

Good account management starts with continuity of care, and NWC Inc. is interested in personalized service. All the outsourcers touted their dedicated teams of account reps, but EDS' size and maturity gives it an edge in well-ordered account management. Likewise, Savvis' account-management process seems able to handle the largest accounts, yet we felt a business the size of NWC Inc. would be well-served. Globix would provide a dedicated team of account representatives, a sales engineer and NOC contacts but it lacks the division of duties and hierarch of responsibility of the other three.

Infosys responded with a formal joint-management proposal that included a defined team of project and trouble reps. Savvis also had hierarchies of project and problem account reps and it outlined the conventional three levels of technical support. A small but noteworthy statement said its account teams sit together in the same office pod. The EDS team is also dedicated and diverse, and backed by an army of problem and project folks.Savvis would provision new servers in 25 to 30 business days, depending whether the server is a Hewlett-Packard DL or a blade --Savvis supports HP, Egenera, Sun and others. Parts needed to upgrade a server are available in 10 to 15 business days. Storage, firewall and intrusion detection/prevention provisioning require as long as 20 days.

For new server provisioning, EDS projects 60 calendar days, on average, given hardware procurement, a software application install and no data migration. This is a good example of the procedure required of all outsourcers, and of what it means to lose control when outsourcing. The extended time line to design, build, test, pilot and tune up a server ensures that the service provider can guarantee all the queues in front of each of these steps won't delay the process longer than the guaranteed number of days.

For management tools, EDS and Savvis seem serious about knitting all the monitoring, fault, change, project and trouble sources together to track service levels--so serious they both have proprietary operations support systems that gather data from underlying monitoring and service desk products. Globix and Infosys didn't mention an OSS, but like EDS and Savvis, both use tools from the Big 3 management vendors--CA, HP and IBM.

Globix uses HP hardware exclusively and make a point of stressing its reliability. EDS uses Sun equipment exclusively for Windows and Solaris 10. Because Infosys required NWC Inc. to supply its own hardware, no operational preference was defined.

EDS, Globix and Savvis all include OS licenses but required NWC Inc. to provide application licenses. Again, Infosys' reliance on NWC Inc. gear meant it would be up to us to maintain all licenses.Savvis and EDS both provide SANs for primary and backup storage systems. Globix proposed dedicated SCSI-attached storage. Infosys would use the storage supported by NWC Inc.

Savvis, EDS and Globix all provision systems, have patch procedures and depot spare parts. Savvis and EDS proposed redundant servers and utility computing virtualization. In fact, their proposals at times read like utility-computing manifestos.

Data center network connectivity is especially important for outsourcers--they must be sure their LAN and WAN connections are redundant. Additionally, network services offered by the outsourcer must meet NWC Inc.'s security needs, as well as support other network services for future growth, like VoIP.

Savvis gave us the most WAN info, including class of service, end-to-end circuit provisioning, and the location and configuration of all its worldwide PoPs. EDS focused on redundant DWDM OC-192 rings and would provide 3-Mbps transmissions between our Green Bay and Syracuse offices and 2-Mbps links for our servers to the Internet. Gotta like both, but EDS was more to the point.

All four vendors dedicate switches, network and firewall connections for managed server environments and use VLANs to segregate traffic.EDS and Savvis provided the most specifics on network services. We asked for info on firewall, VPN, security, voice, video, Internet, IDS/IPS DNS, DHCP, packet shaping and SSL acceleration. All the vendors had managed firewall services with specific options, except Infosys, which said it would configure to NWC Inc. requirements; we'd have preferred the detail offered by rivals. Infosys, Savvis and EDS have hosted IP voice services.

Powerful Setups

Environmentally hardened buildings are table stakes for outsourcers, and all our respondents had good stories to tell. All offered N+1 redundant designs for power and air conditioning, including attachments to two different grid power suppliers. Both EDS and Savvis earned an edge by describing their power setups in great detail, including contracts for diesel fuel, and fire-prevention systems to detect potential combustible prefire conditions, where gases, smoke and temperature precede combustion.

As for security, all four vendors included proximity cards, biometrics, controlled access and security guards. Infosys even added searches. Little differences were interesting, like a two-week supply of diesel fuel from EDS, the "Man Trap" security-enforcement door at Savvis, a power-monitoring Web portal from Globix, and equipment built on "earthquake-proof islands"-- which aren't really islands, but data centers seismically designed to ameliorate the local earthquake risk--from Infosys. They're built on raised platforms spaced from peripheral walls, so the data center is protected from external wall collapse. These guys are ready for things that go bump in the night.

After a thorough review of the four RFIs, we selected Savvis IT Utility Services as our Editor's Choice, and our pick to get NWC Inc.'s business. EDS was a close second, matching and even exceeding Savvis in some scoring categories, such as service levels and WAN connectivity. But it quoted significantly higher initial and ongoing prices, a deal-breaker for a small company. Savvis delivered utility computing, excellent service guarantees with a flexible, robust support system, for a price that makes it worthwhile to relinquish a measure of control.Globix doesn't leverage utility storage, and its service levels aren't quite as strong, but it did make our shortlist, unlike Infosys, whose response was not detailed enough for NWC Inc. to make an informed outsourcing choice. Full RFI responses are available here.

Bruce Boardman executive editor of Network Computing, tests and writes about network management and systems. He has 12 years' experience managing networks and distributed computing for a financial service provider. Write to him at [email protected].

How Successful Is Your Outsourcing Relationship?

Gartner suggests using these key performance indicators and asking these questions to determine the viability of our oursourcing relationship.

Source: Gartner

RFI ScenarioNWC Inc. is a small manufacturer and retailer of widgets with headquarters in Green Bay, Wis., and manufacturing facilities in Syracuse, N.Y. Our 207 employees serve up widgets for 600,000 customers.

NWC Inc.'s network IT staff is small--just seven people in Green Bay and five in Syracuse--and the day-to-day management of our data center has been hindering us from developing revolutionary technologies that could put our widgets light years ahead of the competition. We decided to explore outsourcing our provisioning, networking, maintenance and systems support tasks.

We can be flexible about how much work moves off-site; we'll base our decision on the available levels of WAN, LAN, OS and network and storage system support; cost; security, both data and physical; uptime guarantees; and how much attention our small business will get from the outsourcer. NWC Inc. is a 24/7 e-commerce shop, and we need data center operations that will keep us up and selling, so service levels and support are just as important as price in our evaluations.

Read more about NWC Inc. at inc.networkcomputing.com.RFI Company Replies:
Infosys Response
Globix Response
SAVVIS Response
EDS Response

Savvis IT Utility Services
Savvis combines strong service levels and utility computing at a reasonable price. And, its support teams are on the hook until you're satisfied.

We liked that NWC Inc.'s Savvis Client Account Manager (CAM) would have total responsibility for the service delivered to NWC Inc. This would include regular meetings to review installations, resolve problems, or consult regarding capacities and service levels as indicated by the monitoring Savvis does. It would be up to our CAM to sign off on any services implemented for NWC Inc. and to perform escalations.

Our availability SLA would offer credit after two hours of time, so there would be a strong motivation for Savvis to get our service up and running. Customers must request credits within 30 days, and credits not claimed are lost. We would like to see credits automatically applied. Until then, NWC Inc. would have to audit its bills and performance history monthly.

Savvis helps customers meet compliance standards such as SAS-70 Type II and Sarbanes-Oxley though their audits and best practices. The provider is performing an ISO 9001:2000 gap analysis to further align ITIL (IT Infrastructure Library) practices for ISO certification.

Through the SavvisStation portal, NWC Inc. would be able to view a range of statistics related to access circuits, server memory, disk and processor usage. This could be done on a daily, weekly, monthly or yearly basis and would provide all the information needed to assess the performance of each NWC Inc. server, network, connection and Web site.

Weekly full backups with daily incrementals and a six-week retention policy were included in Savvis' quote. This is a disk-to-disk option, but disk-to-tape with two-week retention and an offsite vault service, which includes data archival and rotation, would also be available.

Three storage options are available through S-SAN, the Savvis Storage Area Network, which is made up of multiple physical SANS. QOS 1, 2 and 3 relate to RAID 1, 5 and 7 respectively. Savvis quoted us QOS-1 with mirrored RAID 1 drives. Volume management of the drives would be handled centrally by Savvis, with capacities up to 600 TB possible on one physical S-SAN. Savvis further touted the throughput of its meshed S-SAN, which it says provides vastly improved throughput, claiming the ability to concurrently handle different application loads, like OLTP and data warehousing. Storage configurations specified in the RFI for NWC Inc. were underconfigured for the directory server at only 1 TB and correctly configured for the database server at 2 TB. We added the additional 3 TB to the Savvis pricing proposal.Savvis installs hardened versions of operating systems. Patches are tested prior to deployment, and only essential server services are enabled. Smoke and heat detection link to dry-pipe sprinklers; this means that if heat is detected, the pipes are charged with water, but only the sprinklers nearest the fire go off. Once heat is reduced water is turned off at the source. A nice addition is the mention of multiple standing contracts with various fuel suppliers.

EDS Data Center Services
We were pleased that EDS answered our RFI; it was interesting to see how one of the largest data center service providers would fulfill the needs of a small company like NWC Inc.

EDS defined mature processes for performance management and service-level monitoring that included capacity management, production control, resolution and relationship management. Fault monitoring and procedural processes were defined in detail. Monitoring would be 24/7 on five-minute polls. Server availability and performance threshold alerts are sent to the EDS operations team. Faults are responded to within 15 minutes, and categorized into one of four severity levels based on business impact. We like this concept.

When it comes to certifications, EDS is No. 1. The short version includes ISO, BS 15000, CMM/CMMI (Capability Maturity Model/Capability Maturity Model Integration), Cobit, ITIL, NSA and Six Sigma. EDS' service-delivery hierarchy employs ITIL operational standards. This is typical of the EDS response, which defined actions through its organization.

Remediation of service-level failures wasn't specified in the EDS response; the company says all remediations are unique to the contract and negotiated. However, it did give us some ballpark guidance. A failure in availability, reducing systems from 100 percent available to 99 percent to 99.99 percent, would result in 10 percent of the monthly recurring charges for that service available as a credit. If availability degrades to 89.99 percent or less the credit rises to 50 percent. EDS stressed that this was only and example and specifics must be worked out. Credits are generally applied manually based on customer audits, but in some cases EDS said this could be automated.

EDS says it spends more than $100 million annually on training and development; this translates to a stable workforce that helps the company meet the service agreements promised to NWC Inc. and others. EDS has a real-time Service Excellence Dashboard that would relate metrics to NWC Inc. and let EDS measure its performance. The interface is customizable and available to multiple users and represents the underlying service infrastructure and process that EDS says drives all its operations.

EDS proposed a Sun-only server hardware environment to support Unix and Windows. Further, the proposal suggested moving NWC Inc.'s Green Bay Windows SQL and Syracuse Oracle servers off Linux to Oracle 9i or 10g running on Solaris. Our concern is our proprietary stored procedures--even with EDS doing the conversion work, NWC Inc. would need to consider the impact to its personnel and other systems.

EDS proposed RAID 1 storage and backup to its SAN. Database servers are clustered and attached to the SAN. Servers are connected over load-balanced clustered links with back-end SAN storage connections. Network services would include managed Cisco firewalls and SSL acceleration.Disaster recovery as a service also would be available from EDS; for the truly paranoid not satisfied with EDS' umpteen data centers, the company offers offshore and near-shore relationships for disaster recovery with other data center providers.

EDS security response indicated proximity cards, live security guards and video systems. Data security leverages dedicated network, server, storage and firewall configurations.

Globix Managed Hosting

Globix also did a good job defining the specifics of service response. Firewall changes are supported during business hours, within two hours. Equipment power cycling is available 24/7, with a maximum wait time of 30 minutes, limited to three cycles per month. Failed equipment replacement is available 24/7.

Globix defined service outage severity like Savvis and EDS did, measuring service impact. Going a step further, Globix added expected restore times, while EDS and Savvis provided only response times.

Server availability wasn't guaranteed. Globix said it monitors with HP's Insight Manager and often proactively handles repairs without negative impact. That's good but not as good as a guarantee.Globix offered one day's hosting credit for the first SLA violation per day, with a maximum of seven days' credit per month. We could opt out of the contract if violations are chronic. Globix has a customer-facing Web portal for monitoring site services, receiving critical updates, reviewing product choices and communicating to our Globix account team.

Legato is used for backup, but Globix priced only 50 GB worth, so NWC Inc will need to add more capacity. Globix runs backup and restores to disk. These backups have a six-week retention with daily incrementals and weekly full backups. Offsite retention is available.

Globix would provide providing NWC Inc.'s database servers with a shared database using a RAID 6 StorageWorks MSA500 SCSI-attached array. The initial size will support 6 TB, a bump from the 4 TB NWC Inc. currently has configured. The array can be increased to 7.2 TB, leaving room for growth. Globix didn't include SAN support.As patches become available, Globix would notify NWC Inc. Patch access would be available through the Globix portal--we could apply them ourselves or have Globix apply patches for a fee. Patches are never automatically applied to customer applications. Globix would monitor systems using agents. NWC Inc. would have access to monitor these scanners.

The large international network Globix described is noteworthy; its trans-Atlantic and trans-continental backbone has 400 global peering partners, including BT, MCI and SBC. Globix showed its PoPs in a document attached to the RFI, by city globally and in detail for the northeast United States.

Globix detailed amperage availability, power equipment, power drops and exceeding TIA standards. Security includes proximity cards and biometrics as well as roaming security guards.

Infosys Technologies Data Center Management Services
Infosys' response was light on detail, making it difficult to judge whether it would be a fit for NWC Inc. The provider often claimed it could meet our requirements, but then didn't elaborate. Regarding systems support, for example, the other vendors specified the server hardware they would use to run our apps. Infosys talked about a flexible dedicated or shared model but didn't specify the hardware.

Infosys did cite extensive quality processes that are ITIL and BS 15000 compliant. It mentioned setting initial performance indicators and subsequent review, analysis and remediation plans. But no specific guarantees were made in this RFI, and no timelines were explained. We went back to Infosys for more detail, which helped, but still left us wanting. Because scoring is based on information provided, Infosys' grade suffered.Infosys has a well-defined group and organizational structure for account management but again didn't illustrate the details of problem and project management available in the Savvis and EDS responses. So, we know Infosys has defined best practices, but we don't know much about how they would work.

NWC Inc. would be assigned an Engagement Manager as the single point of contact, but he or she would work within a team of technical and project management individuals, creating a Joint Management Council with people from the Infosys Relationship team and NWC Inc. Infosys gave significant detail regarding job descriptions of each role on its account support team. Not all of it directly relates to customer-facing activities, but we have no doubt as to what they do to earn their paychecks.

The RFI detailed training of the Infosys staff. Bringing newly hired and promoted junior and senior engineers up to speed would involve six months of formal training. Very impressive internal development. Technical and leadership courses are provided to employees, as is language training, specifically the neutralization of accents, where needed.

A dashboard portal would provide a near-real-time Web interface to show both high-level system health and specific performance metrics like CPU and I/O. These instances are tracked against SLAs and stored for historical views.Infosys' says its WAN backbone has PoPs in the United States and United Kingdom, though specific locations and number of PoPs were not listed. Connections for NWC Inc. would be in Boston, but unfortunately, the cost of those connections weren't included in the Infosys response. The main data center is in India and seems to be well connected with redundant providers. However, there's no SLA regarding the network, which is a concern. The Infosys RFI does suggest that a VPN across the public Internet is an option, an unattractive choice given the other outsourcers' dedicated WAN connections.

As for security, Infosys matched the other entries in this review, and it searches cars going in and out of the parking lot. That'll teach ya to cop paper clips. In addition to the usual fire detection, Infosys noted that water stored on site is tested weekly for potability.

R E V I E W

Outsourced Data Center Services

Sorry,
your browser
is not Java
enabled

Welcome to NETWORK COMPUTING's Interactive Report Card, v2. To launch it, click on the Interactive Report Card ® icon above. The program components take a few moments to load.

Once launched, enter your own product feature weights and click the Recalc button. The Interactive Report Card ® will re-sort (and re-grade!) the products based on the new category weights

you entered.

Click here for more information about our Interactive Report Card ®.