Infrastructure as a Service

Infrastructure as a Service (IaaS) models inside traditional information technology departments are taking shape in the financial services industry. Although IaaS is not the norm in the industry, and it won’t be a fit for all institutions, credit unions that choose to deploy this emerging technology can experience a positive impact.

Loosely defined, IaaS is a form of cloud computing [alongside Platform as a Service (PaaS) and Software as a Service (SaaS)] that provides virtualized computing resources for whatever systems the credit union chooses (more on this idea later).

In an IaaS model, a third-party provider hosts hardware, software, servers, storage and other infrastructure components on behalf of its clients. IaaS providers also host users' applications and handle such tasks as system maintenance, backup and resiliency planning.

IaaS is not the traditional service-bureau-application-centric model provided by industry vendors for core, online banking and mobile solutions. Instead, under this model much of the maintenance for underlying servers, desktops, and disaster recovery is outsourced to a vendor rather than maintained by in-house IT staff.

IaaS customers pay on a per-use basis, typically by the hour, week or month. Some providers also charge customers based on the amount of virtual machine space they use. This pay-as-you-go model eliminates the capital expense of deploying in-house hardware and software.

A successful IaaS initiative can yield numerous benefits. It can:

• significantly decrease spending, producing a positive, quantifiable return on investment;
• provide strategic flexibility for the organization, as IaaS removes the need to invest in certain large fixed assets, for which the investment is the same regardless of usage--with IaaS, these costs now vary with use;
• identify existing points of failure in the data center, such as security weaknesses or defective hardware; and
• enable acquisition of the latest hardware and software on a continuous and budget-friendly cycle (without having to budget one year for a large purchase of fixed assets, for example), ultimately delivering better performance and agility.

Before embarking on an IaaS strategy, credit unions should include three key elements in their decision, which we’ll explore more below:

• business case,
• vendor selection “gotchas” and
• regulatory response.

Building the Business Case

IaaS should not be evaluated on a cost/benefit analysis like a traditional capital expenditure would be. Instead, everything should tie back to the existing IT operating budget. Credit unions building a case for shifting to an IaaS model should first:

• perform a financial analysis of the new IaaS model and existing deployment strategy, including an evaluation of the depreciation run-off of all equipment impacted by the project (e.g., hardware, licensing, software, maintenance and contracts), and
• compare these results to analysis of a five-year timeline with an IaaS model.

These analyses will expose large capital expenditures that happen roughly every five years (e.g., storage area networks, software, desktops and servers) along with operating expenses.

There are big savings to be realized here: One mid-size financial institution that executed IaaS with its desktop fleet uncovered 25 percent to 30 percent savings over its five-year financial analysis.

The ‘Gotchas’ to Avoid

Pain points along the way can be side-stepped if credit unions know what to look for in the service and what to avoid. Partnering with the right vendors is imperative when taking on the IaaS model. Vendors will claim they are able to do anything needed to get from proposal to signed contract, but credit unions should be aware that negotiating the terms of an IaaS contract is considerably different from negotiating a bulk purchase of desktops or servers. IaaS contract terms must consider service-level agreements, vendor management, and the service delivery framework, to name just a few.

Keeping the following considerations in mind during the decision-making process will help credit unions avoid vendor “gotchas”:

• When getting into an IaaS model, the focus should be on implementing the new model for one service at a time. A wise approach would be to start an IaaS model by outsourcing things that are not member- and employee-centric services, such as disaster recovery. IaaS is not an area where it is wise to jump in with both feet and allow an unproven vendor to run primary, production-level services.
• Don’t automatically choose larger, global vendors over local providers. The local vendors, by nature of their smaller client base, tend to be more attentive and flexible in their offerings.
• The functions that will be kept in house and those that will be managed by the vendor must be clearly documented. For example, how will the vendor execute on things like patching, application updates, hardware maintenance, backup schedules and Microsoft upgrades?
• Rather than rely on the vendor’s financial analysis, it is better for the credit union to build its own based on known, hard-cost savings.
• The IaaS vendor partnership is a long-term relationship that requires a deep level of trust. Even so, relationships change over time, and a strong exit strategy must be documented in the contract.

Regulatory Response

Regulators don’t like surprises. A credit union taking on an IaaS initiative needs to share its plans to outsource with regulators prior to executing the vendor contract. The credit union will need to complete a formal risk analysis with detailed plans to sustain monitoring and must be ready to provide past audits, a business case, and a list of any other planned projects.

Having a strong IaaS governance program in place with a focus on vendor management will go a long way toward eliciting a favorable response from regulators. An in-depth review of all plans and policies from an independent, outside source is a good regulatory safeguard.

Agility and creativity are essential in this ever-changing digital world. IaaS can produce significant results by decreasing spending, providing a flexible cost model, reducing risk and delivering better performance.

Ryan Rackley and Emily Waite are directors with Cornerstone Advisors, a CUES Supplier member and strategic partner based in Scottsdale, Ariz.