This blog was co-written with Melchior du Boullay, General Manager, Americas, at oXya.
The decision to outsource your data is not an easy one. It consists of at least two major steps:
- The first step is for you to make a decision that you want to outsource your SAP environment; in other words, you decide that you would like to entrust a 3rd party with providing ongoing managed services for all your SAP operations;
- Then, once you’ve decided to outsource, the second decision is for you to select an outsourcing partner; be mindful that it is a partner that you are choosing, not a vendor.
Each of the above two steps has various questions and concerns that customers address. Some are questions they must ask themselves, and some are questions for the partners they are interviewing. Then, after you’ve made the decision, comes the actual process of transferring your current SAP systems to the outsourcing partner; or working with that partner from the beginning, to build your new SAP environment.
In a series of blogs we’re starting today, we will address all of the above. We will share with you from the experience of oXya, who has been managing SAP environments for enterprise customers for the past 18 years; these days we are managing SAP environments for more than 260 customers, with supporting over 250,000 users. This is the experience, on which this blog series is based.
In today’s blog, “Outsourcing SAP: Should We Outsource Our SAP Environment?”, we address the first decision. We will cover the various questions and concerns that customers ask and examine, when they decide whether to manage their SAP environment in-house, or to use a partner to provide managed services for them.
Next week’s blog, “Outsourcing SAP: Choosing a Partner to Manage Our SAP Environment”, will address the second part of the decision. Next week we’ll discuss how to select an outsourcing partner, and suggest some important criteria regarding what you should look for when interviewing partners and comparing between them, to make sure you select the best partner possible for you, to which you will outsource the management (infrastructure & ongoing management and support) of your SAP environment.
Then, in additional blog posts, we will dedicate a blog to the questions around infrastructure and headcount; we’ll describe how the process of actually transferring your current SAP systems to oXya actually works; and we’ll end up with a blog that answers the questions we’ll get from you, the readers, throughout this series.
But before we dive in, let’s first clarify that when we say “Outsourcing SAP”, it doesn’t necessarily mean to outsource your infrastructure. Rather, it can mean that you keep your infrastructure in-house, and only outsource the support services, meaning you get managed services that are based on your own infrastructure. At oXya, we have customers of both “types” – some asked us to handle their entire SAP environment, meaning to run their SAP on our own infrastructure, at oXya’s datacenters around the world; and some customers preferred to keep their own infrastructure, in-house, and have manage their SAP support services.
Should We Outsource?
This question is always an internal one, within the organization; furthermore, it is often a political question, and has nothing to do with technology or any specific partner. There are various reasons why organizations decide to outsource their SAP (or keep it in-house), and these include the service levels provided to the business; infrastructure considerations; headcount; various accounting dilemmas (Capex vs. Opex); and more. Here are some thoughts about a couple of these reasons:
Infrastructure: fact is that most companies do not operate their own datacenter. Owning the datacenter is something that is typically only done by very large enterprises, those with lots of financial means (and even then, not by all large enterprises).
When a smaller company owns its datacenter, it will usually need to make some compromises: the datacenter will have small space (closet-type space), with very little redundancy. That is why the outsourcing model has great advantages for most companies. If you go to an outsourcing company and ask them to take care of your systems, such a company would typically have a full datacenter, redundancy in place, possibly a second datacenter for disaster recovery purposes, and more.
These are big advantages to the outsourcing model. All of that infrastructure, that supports your SAP environment, is very costly when you’re trying to do it on your own and maintain everything by yourself. However, it’s quite easy and affordable for the outsourcing provider (which offers the service to many companies), and of course it’s also easy and affordable for the customer, who purchases a service, and not the full infrastructure and everything around it.
Headcount: this is often seen as an advantage for outsourcing. For some companies, headcount is an important metric and managers are often asked to lower their headcount. Once you adopt an outsourcing model, all the technical people who manage your systems and provide you with SAP support are not considered part of your headcount.
When working with oXya, we take care of all the SAP Basis aspect so you don’t need any internal SAP Basis people. You also don’t need any database administrators, because our experts are taking care of that as well.
We will dedicate another blog post (beyond the two mentioned above) to deal with the above subjects questions (infrastructure, headcount) and additional ones regarding outsourcing your SAP environment. In that blog, we will offer ways to look at these dilemmas that will help you get to a decision.
In this blog, however, the starting point is that you’ve already gone through the decision process described above, and decided to seriously examine the option of outsourcing your SAP service. Hence, in the remainder of this blog post, we will cover the various questions and doubts that you now need to deal with.
The Security Concern
The question of security is the first concern that each and every company always has, regarding outsourcing their SAP systems. It is also an important question to address. The bottom line answer? Yes, you can have a very secure internal environment, in-house, if you can afford it. It all depends on your resources. Because security, much like many other things, depends at the end of the day on how much you are willing to invest in your infrastructure, training and procedures, when you’re hosting your IT internally.
The main concern regarding security is a trust issue. Do you trust an external company with handling your most valuable data? Do you trust that they have procedures in place, to restrict access to the systems and data? This is the most common concern when considering outsourcing.
Here’s the simple answer to that concern: when you decide to outsource, you obviously need to select a partner that you can trust. Once you found a partner that you can trust, then the risk—from a security standpoint—is not necessarily greater than the risk from your own employees. To explain that, let’s look, at a very high level, at both external attacks and internal ones.
Regarding external attacks, you obviously need to protect yourself from them, and this is what firewalls and IDS/IPS solutions are for. All of these solutions protect your systems from external attacks, and these solutions can be replicated in an outsourced environment. In fact, it’s quite possible that an outsourced environment will have more solutions and more security measures in place, compared to your in-house systems; this is typically very visible when talking about security procedure (what are the processes to prevent attacks; how to react when an attack has been detected) as this is the core of the business of your potential outsourcing partner.
However, the main security threat is always your internal people, meaning some sort of attacks that leverage internal access. When an attacker wants to get access to your data, the main vector of attack will go through your internal people. If someone can get to them, then the attacker will have a pretty easy access to your systems. This is true whether you run your systems in-house with your own employees, or through a managed services partner. In my view, the nature of the security threat doesn’t change much once you move to outsourcing.
Couple of examples to the types of internal security threats that I’m referring to include:
- Mishandling passwords: someone who has a weak password, or wrote the password on a piece of paper, or someone who gives a password to someone else who should not have it.
- Disgruntled employee: if someone internal wants to harm you, then obviously it’s easier for them, compared to someone external.
Still, the above threats will be the same, whether your IT is in-house or you manage it through an external managed service partner.
You can and should request your SAP managed services partner to put in place the same type of protections that you have internally. Typically, this means things like background checks on the team that handles your systems (internally or with the external partner; we’ll touch on that in the next blog), and similar preventative measures. The bottom line is that in my view, the security threat is similar whether you have your SAP systems internally or you outsource them. Again, in this case, this is the core of your potential partner’s business, they should have no issues to at least match what you have currently in place, in terms of security procedures.
The Responsibility Consideration
The second major consideration when you want to do outsourcing, and especially SAP outsourcing (which is what we specialize in), is the responsibility consideration. To be clear, outsourcing doesn’t mean that you—the CIO, or the person who leads SAP in the organization—no longer have any responsibility, and that you can give all the responsibility to the managed services partner. Not at all.
One of the most important things that you need to think about when you do outsourcing, and especially when you outsource your SAP, is that you need someone to manage the relationship with your outsourcing partner. In our case, typically we need an IT person that works for the customer, to be the link between the customer’s user community, the customer’s internal IT resources, and us at oXya. This is relevant for any SAP issues, SAP projects, and even the daily management of the systems.
An example for the daily cooperation is that we send daily reports, and these reports need to be read by someone. So, you definitely need a resource on your side (the customer) whose job it is to manage that relationship. It’s not necessarily a full time job, but it’s something you should keep in mind when you decide to outsource. Furthermore, having someone specific who manages the relationship is especially true if you have multiple, specialized outsourcing partners. The more outsourcing partners you have, the more work it will be to coordinate between them.
Let me give you a very specific real-life example. We have a customer that decided to outsource their entire SAP infrastructure. They selected one partner just for the datacenter part, a second partner for the SAP managed services part, and a third partner for the SAP functional part. So, they ended up having three different partners for their SAP landscape. That is a lot of partners, around only one system.
What does it mean, in daily life? It means that for every issue, they have to coordinate with these 3 entities; make sure that everyone is aware of everything going on; and that these 3 partners are communicating between themselves and with the customer, in order to resolve that issue. That is a lot of work, and it needs to be taken into consideration when you select your outsourcing partners. If you decide to outsource to multiple different partners—and there are good pros and cons for such a move—then you have to take into account that it will take a lot of time to manage these partners.
How many outsourcing partners?
To continue the on the same subject we started above, there’s another thing you should consider regarding the number of outsourcing partners you select. When you have several outsourcing partners involved, like in the above example, you also need to take into account that all processes will take longer. Meaning, it will take longer to resolve issues, to perform upgrades, and so forth – due to all the coordination work needed between the various partners that support the SAP environment.
Let me give you an example, and I’ll tie it into the oXya model of servicing customers. When we are working with customers, we prefer to take overall responsibility over your SAP environment, including datacenter, infrastructure, SAP Basis services, databases, and more. Another alternative is for the customer to own the hardware, and oXya provides the SAP manages services.
How does it work? Let’s take a case where you own the hardware, and oXya performs the SAP managed services. You give us a call regarding an issue you’re experiencing. You call directly to the team leader—he is an SAP Basis admin as well, with many years of experience; with oXya, you don’t call a call center and wait for someone to get back to you.
Once you convey the issue directly to the team leader, he is able to determine immediately what type of issue it is, and start working on the resolution with the specific oXya team that is assigned to service you (each customer has a specific team assigned to them). The team will identify whether this is an SAP issue, a database issue, an infrastructure issue, and so forth. Then, as soon as the cause has been identified, the oXya team can immediately begin working on the resolution. Even if it is an infrastructure issue, the oXya team can still call to order a replacement part, and take immediate actions by themselves (remember that in this example, the infrastructure is owned by the customer and is under the customer’s responsibility, but oXya would still help resolve the issue. Obviously, things work at least as fast when the infrastructure is owned by oXya and is under our responsibility).
So where do the issues begin, and processes begin to take longer and longer? The additional time comes in when neither oXya nor the customer own the hardware, because the customer selected a different partner for the hardware. This means that we (oXya) have limited access to the hardware and to the operating system. It also means that it’s going to be more difficult to troubleshoot some issues and identify the root cause. And on top of what I already mentioned—when the hardware is not owned by oXya, then we can only give our recommendations and ask to check specific things, but we are not able to perform the operations by ourselves; the actual ordering of the parts and performing the operations will need to be done by the other partner. And all of these things always and definitely add some time to the resolution process.
The rule of thumb, when considering the number of partners you will outsource to, is that the more partners you include in the process, the slower everything will be. The other party needs to be aware of the issue, run tests by themselves, perhaps validate something on their side, and only then order the necessary parts to solve the infrastructure issues.
General outsourcing partner, or an expert one?
In addition to the question regarding the number of outsourcing partners, another question you’ll need to deal with is what type of outsourcing partner you want to choose for your SAP systems. At a high level, there are two options:
- Outsource your entire infrastructure and all applications to one “generalist” outsourcing partner
- Use specialized outsourcing partners to handle specific applications
The two options listed above represent two schools of thought. At oXya, we believe in specialization; we specialize in SAP and related systems (e.g. databases and more) at the highest level, so obviously we have a very firm opinion on which approach is better. We also have many customer success stories that support the specialized outsourcing model. In this model, you entrust a portion of your IT infrastructure and applications to a company that specializes exactly in that area, and have expertise in that area. This company does everything around certain applications, but not necessarily everything related to all your applications and IT operations. In other words, it means you may need several outsourcing partners for different applications. This way you get the best, most specialized service.
Note that the multiple outsourcing partners mentioned in the previous paragraph, a specialized partner for specific applications and everything around them, is very different than the multiple partners we discussed in the previous section. Earlier, we discussed the case of several partners that handle various tasks related to the same application (one partner for SAP services, another partner for infrastructure), so the process ends up slower and tends to be problematic. In this case, we’re talking about a specific, specialized partner for everything related to SAP (or other applications), so the end result is actually better and faster service.
As already mentioned, oXya specializes in SAP Basis, and due to that we are a very good partner for any SAP Basis needs. We can provide managed services on-site, meaning you have your own datacenter, want to keep it because you’re happy with it, and you just want a company to provide the SAP Basis services based on your own infrastructure; or you want to leverage oXya’s datacenters and infrastructure around the world, in which case you can outsource just your SAP systems, and access them via MPLS (for example).
The other option, which we’re not going to expand on, is the one we actually listed first – hire an outsourcing partner that will handle all of your applications, and in some cases all of your IT needs. These types of outsourcing partners are often the biggest, most famous names out there, so it sounds like a “good bet” to entrust your entire IT in their hands. Furthermore, this approach also sound simpler to execute and manage on an ongoing basis, since you have less partners to manage.
However, real life experience shows that such “generalist” outsourcing often comes at the expense of expertise. Also, you would often suffer from slow service, since you don’t know who exactly, from their multiple service centers around the world, will handle your specific, current issue, and how much time it will take. Resulting from that, you’ll encounter support personnel that do not know anything about you and your systems (each issue may be handled by different teams, in different time zones), and more. oXya has many happy customers, that came to us after being burnt with outsourcing partners of the “generalist” type.
To summarize what we discussed in this blog, remember that:
- The security threat is not greater when outsourcing your SAP systems, compared to managing everything in-house;
- Once you’ve decided to outsource your SAP systems, it doesn’t mean that all responsibility has been transferred to the partner(s); you still need someone in-house to manage the relationship;
- When considering the number of outsourcing partners related to SAP, keep in mind that the more outsourcing partners you have involved with your SAP systems, the more work it will be for the in-house person responsible for the relationship;
- Keep in mind that the more outsourcing partners you have related to your SAP systems, the longer it will take to resolve each issue, since each issue will bounce between the various outsourcing partners;
- And last, when choosing between a “generalist” outsourcing partner and one that specializes in SAP (or specializes in other, specific applications), we recommend going with the specialized partner, and giving them the full responsibility over that application and everything related.
Our next blog will discuss the question of how to choose the right partner to manage your SAP systems.
Please post any questions you have about “Outsourcing SAP” to the Comments below, or send them directly to us, Dominik Herzig <firstname.lastname@example.org> or Melchior du Boullay <email@example.com>. We will address all of your questions.
Dominik Herzig is VP of Delivery for US & Canada at oXya. Dominik has 10 years of SAP experience, starting as a Basis Admin, and then moving to SAP project management and to account management. Dominik was one of the first few people to open oXya’s US offices back in 2007.
Melchior du Boullay is General Manager, Americas, at oXya, responsible for all of oXya’s operations across North, Central and South America since 2007, when oXya started operating in the Americas. Melchior has nearly 15 years of experience as an SAP Basis admin and technical consultant, SAP project manager, SAP account management, and business development.
oXya, a Hitachi Data Systems company, is a technical SAP consulting company, established in 1998. oXya provides ongoing managed services (outsourcing) for enterprises around the world. In addition, oXya helps customers that run SAP with various projects, including upgrades and migrations, including to SAP HANA. oXya currently employs ~600 SAP experts, who service more than 260 enterprise customers with more than 250,000 SAP users around the world.