The world of IT is changing. When ABT first started back in 1999 most of the sales cycle was spent educating prospects on what the heck "managed hosting" was. Times have changed. With terms like SAAS (Software As A Service), "Cloud Computing", "Virtual Access" now being used by prospects themselves, the time of "teaching" has been greatly reduced. As everyone becomes more familiar with the terminology, the barriers of moving critical data have lowered. The tools being used today are far superior than they were 10 years ago, when ABT first started. Moving data off an "in-house" system to an outside hosting facility is not as difficult as it once was. In some cases it is an easy process, perhaps too easy. I wonder, with this ability to move quickly, is the process of due diligence still being performed on the hosting company being considered? Or, has the process become so easy a perception of "all hosting companies are the same" comes into play. Are you being drawn to the lowest price as your only consideration? Where are you really sending your critical systems? The hosting company of choice needs to be solid. They should be an expert in the software platforms you use. You should be asking questions.
Here are 5 questions you should ask:
Question 1:
Can I come to your office and data center? Explain this as part of your due diligence process for selecting the best company to run your systems?
Your goal is to find an organization who has invested in their business made a substantial stake in their organization which will make it difficult for them to walk away from their hosting commitment. You are relying on them to house and protect your critical data. What do you look for to help ensure they will be in business tomorrow? Is there a real office? Do they own their building? Do they own their own equipment? Do they have financial backing? Or is it all virtual?
Question 2:
How many data centers do you utilize when hosting?
Note: you are not just looking for quality but also quantity.
Your client's mortgage data and its safety is your responsibility. I do not know of a document with more personal information on it than a Mortgage Loan. Make sure the company you choose has a regularly scheduled back up process in place. Your data should, at a minimum, be backed up on-site regularly. Solid hosting companies will take further steps and replicate to either an off site storage facility or Disaster Recovery Data Center.
Question 3:
Do you offer a Fail-Over and or Disaster Recovery Environment options?
Depending on your business, you may require a "hot" fail over environment to be accessible in minutes, if your primary environment goes down. This mirrored environment is normally running beside your primary environment in the same Data Center. Your next line of defense is called a Disaster Recovery site. This is an environment which has the same make up as the Primary and Fail Over site. It should be set up in a different region as the primary site. Out for example, is located 650 miles from the Primary Site. Data should be refreshed each night. The system is usually kept in a "warm" state (helps with cost factors). It can generally be spun up in a few hours. This system is available if the primary data center incurs a catastrophic failure. These added environments should be considered an insurance policy. You hope you never have to use them, but they are available just in case. If you decide against these environments consider what happens to your business if your primary system goes down. Can you close up shop for a few hours or perhaps days as the primary system is rebuilt?
Question 4:
What security certification(s) do you have?
All hosting companies who are holding your data especially mortgage loan data should undergo a SAS70 Audit. This is an Audit performed by an outside consulting group. They review the hosting company's procedures and business practices. The auditors look through business process documentation, for possible points of failure. The next level of review is a SAS 70 Type II certification. In this review the auditors are on site to test and observe the procedures stated in the SAS70 Audit report. This is the certification you should be looking for.
For the Hosting Company, these audits are time consuming and financially expensive. I have seen some hosting companies post a SAS70 certificate that actually belongs to the Data Center they have set up shop in. Watch out for this. As a premier hosting company, hanging your hat on the Data Centers SAS 70 audit, obviously does not address how the hosting company protects your data.
Question 5:
Tell me about your Tech Support?
There are all levels of tech support quality out there. It is easy to say your tech support is Gold / Platinum / Superior...whatever... No matter the size of the company or the stated standard/ guarantee, we have all been on the phone at one time or another waiting...and waiting...and waiting still.
To ensure the company you are considering has a tech support process that works... see the bonus question
Bonus Question
When I am ready to move forward, would you provide references?
The user experience of others is precious. Their opinions will expose a great deal of what it is like to work with the hosting company you are considering.
I hope this is helpful...thanks for your time
Chris