Software as a Service (SaaS) Checklist
Software as a Service (SaaS) is becoming a viable option for many organisations, offering benefits in terms of maximising output and providing control of cash flow and freeing up of internal resources.
Currently within my organisation we are actually actively using all 3 cloud technologies in multiple deployments for SaaS, PaaS and IaaS. eg. Lync, Office365, ZenDesk, TiPT, JIRA, Crowd, Confluence to name a few.
The following is a general overview of some of my findings with SaaS including a simplistic checklist for due diligence. Feel free to comment and provide feedback.
Firstly, my opinion:
Within the Australian Aged Care space, I do not believe that there are any Aged Care Industry software vendors, providing an end to end SaaS solution.
Vendors, feel free to put your hand up to challenge this statement.
Find the download link for the checklist if you don’t wish to read the entire post.
[wpfilebase tag=file id=2 /]
My criteria, for an Aged Care Software Vendor to provide Software as a Service offering could be surmised by the following:
1. Subscription based, Affordable and all inclusive
Diverting from the traditional annual software and maintenance license agreement, SaaS is usually sold on a holistic subscription basis that includes upgrades, maintenance and a degree of customer support. SaaS subscription models usually operate on a monthly subscription basis and hence there are no large up-front costs.
2. Zero Infrastructure, Zero System Administrator
My definition for SaaS is that there is zero on site infrastructure, zero on-site administration and the underlying ICT infrastructure is handled by the SaaS vendor. CIOs, IT Managers, Users do not need to worry about hardware maintenance of hardware, operating system compatibilities, database versioning. The SaaS vendor takes care of all of this for the end-user, so the end-user doesn’t have to.
3, Seamless Software Application Upgrades
My view is that the SaaS provider manages the software release cycle inclusive of upgrades. The benefits should be obvious for any organisation or ICT department with the elimination of downloading, operating system patching and the potential for application cross продажа кондиционеров в могилеве termination
4. Service Level Agreements resulting in Guaranteed Levels of Service
How many organisations have any performance guarantee with their software ? SaaS introduces and enforces the concept of SLAs. SaaS SLAs should have quantitative measurements in terms of uptime and how the software will perform. In the event that the SaaS offering doesn’t deliver, the vendor would incorporate a penalty or discount around service. Again, within the Australian Aged Care software vendor space,I do not know of any Australian Aged Care software provider offering a SLA with penalty clauses
5. Disaster Recovery/Business Continuity/Backups and Data Recovery all taken care of
Within my organisation, we are quite familiar with traditional software and systems (some 220 of them actually). We also have case history and proven delivery of BCP/DR outcomes. See http://www.gavintomlins.com/2012/04/sundale-ict-wins-national-award/ . If you are familiar with traditional software, you will know the cost of virtualisation, site recovery and the costly automated solutions that need to be implemented around BCP/DR. The process of backing up your data and providing real time access to systems can be laborious at the best of times. In my opinions, SaaS solutions eradicate this painstaking task, ensuring the lights are on without user intervention and thus ensuring the integrity of your data.
6. Browser based and Work Anywhere
Simply put, have internet connection, have browser, will work. My view is that given an internet connection, SaaS solutions can be accessed from anywhere in the world. The much touted teleworker fits comfortably in the mould of the SaaS model. Users are able to access their data and work more effficiently from anywhere at any time. Gone is the domain of being bound to a desk and a given site.
In my view security would be more onerous in a SaaS offering. SaaS providers should have geographically separated data centres. The chance of social hacking is potentially less and security models are more rigid with processes to be followed as opposed to flexibility in traditional systems
8.Quick and Easy Deployment
As stated previously, my thoughts are on SaaS is all that you should need is a web browser and internet access, and away you go. Gone are the project management and deployment headaches of traditional software with extended time frames. I wish to point, click and provision and for it to be sitting there when I come back from lunch.Find attached, a SaaS checklist that I have used with a few providers whilst doing due diligence.
I’ve included a simple checklist below for consideration with interaction with prospective SaaS Vendors.
I wish to acknowledge Brett Avery of Webstercare, for his outstanding work in responding to the checklist that I have attached. I have had multiple providers across different industries respond to the high level checklist, but none with the same professionalism and diligence that Brett provided. Unfortunately, I’m unable to attach his responses due to confidentiality reasons, but it seriously was a cut above.
A special mention goes to Sonja Bernhardt of ThoughtWare for her prompt replies in good customer follow up. A number of vendors could also learn from Sonja about customer service.
As mentioned above, please provide feedback, as I will revise and share with the masses.
[wpfilebase tag=file id=2 /]
(if the link doesn’t render go to the direct page and find the download http://www.gavintomlins.com/2012/08/software-as-a-service-saas-checklist/ )
The list its entirety (Copy and Paste is your friend) though I recommend the download above as it maintains formatting.
General Organisational Governance & Roadmap
- How many years has Business/Organisation been in business?
- May we please of a general 1 page summary of the SaaS offering
- May we please obtain a roadmap of the SaaS/software development?
- Was the proposed software solution developed by Business/Organisation, or was it originally developed by a software supplier who was subsequently acquired by Business/Organisation?
- When was the first release for the proposed software solution?a. What is the current release for the proposed software solution, and when was it formally released for commercial availability?b. May we please obtain details on Business/Organisation’s Software development life cycle inclusive of quality assurance and release cycle?
- How many developers work on the software or what is the size of the development team working for Business/Organisation?
- What was the size of the team 1 yr. ago?
- What was the size of the team 2 yrs. ago?
- In House/out sourced?
- Does Your Organisation Name have access to the application source code?
a. Is the source code placed in escrow?
- What considerations are given in the event Your Organisation Name provides advice or funds development of the product?
- Confirmations on licensing?
- There is no restriction on the maximum number of concurrent or named user licenses? Do you have a light agent model?
- How does the licensing model apply to reporting? Are there any restrictions?
- How does the licensing model apply to exporting of file formats? PDF, WORD, Excel, XML, CSV?
- Can Your Organisation Name increase or decrease the services/licenses as the organisation needs shift?
- Is Your Business/Organisation billed in advance or only after use of the service?
- Are there any long-term discounts, such a paying for a year to two in advance?
- Is there a minimum contract period?
- Are there termination or other penalty fees?
Technical Support Governance and Service Level Agreement
15. May we please obtain your Business/Organisation’s default SLA for end to end systems management?
- What warranties are provided (and not provided)?
- What disclaimers and limitations of liability are in the Warranties/Contract?
- Are there remedies and/or penalties for failure to meet SLA requirements?
16. Could you please detail the Business/Organisation service/support desk process?
- What are the options for technical support?
- What options can Your Organisation Name choose from?
- Is technical support 24x7x365?
- What support is free and what requires a separate fee?
- May we see an example of contact details for technical support? Is it a 1800/1300 number?
i. Is tech support handled by Business/Organisation or is outsourced? Onshore or Offshore?
- How does Business/Organisation notify of interruptions or downtime, including scheduled maintenance? May we see examples of these?
- How does Business/Organisation respond to slowness or other performance issues?
- May we please see an example of reports/governance of server systems, inclusive ofpatching/security/backup and restore/disk management, server uptime?
- Where are the Business/Organisation Application servers hosted inclusive of data sovereignty details? May we also get an IP address?
- Where are the Business/Organisation BCP/DR servers hosted? May we also get an IP address?
- May we please see a report on the BCP/DR restoration process?
- Can you provide details of user support groups?
- Can you provide details of user support forums?
- Is there a named single point of contact to handle Your Organisation Name’s service account?
Security & Schema
21. What is the security model for the system? What are the different layers?
a. May we please have SSL certificate details?
b. What certifications of any kind can you provide around privacy and security?
c. Can you please provide audit trails of Blue Card authorisation of staff accessing systems?
- How is confidential information handled?
- How does Business/Organisation handle Nondisclosure Agreements? Can you provide examples of this?
- Is the Business/Organisation data provided in a shared data model?
i. How is it segregated/protected?
- How is the data encrypted during transmission and when stored?
- Are there policies and procedures in place for security breaches, data theft?
22. Does Business/Organisation provide a data schema via a NDA?
a. May we please obtain a visual representation/UML diagram of the system inclusive of data/security and transaction model?
- Could you please confirm the database topology that is used, inclusive of year, version, service pack and any licensing considerations Your Organisation Name would need to take into consideration?
- Can you please explain the audit log process for querying of security related matters?
Business Continuity Process/Disaster Recovery (BCP/DR)
- Could you please explain what happens in a BCP/DR situation if the Business/Organisation SaaS server goes down? How up to date is the data in this situation (Sites still have internet access in this use case scenario.)
- Could you please confirm that logins are not bound back to IP?
- What is the process of receiving data snapshots?
- Are there extra charges for backup, restoring data or other services?
- Does Business/Organisation integrate with LDAP (Active Directory)/ Federated/Services?
- Does Business/Organisation support Single Sign On?
a. If so, what is the methodology that is used?
- Does Business/Organisation require installation of any plug-ins or other software to operate correctly?
- Are there any limitations on whom or how Business/Organisation SaaS can be used?
- Are there any restrictions on the types or versions of browsers? ie. What browser platform does Business/Organisation care run through? (Looks like an ActiveX control is required) or are there any restrictions on the database, hardware platform, network, or operating system environment for which the software is compatible?
- Could you please provide us in PDF form example reports from the system?
- Are there any real time messaging options across the platform? Is it possible to see a notification matrix?
- Are there any published interfaces/web services?
- Could you please detail the scalability of the proposed Business/Organisation SaaS solution?
a. Have you quantitative data to demonstrate load and concurrent access to verify the above?
38. Can you please detail Business/Organisation SaaS support for mobility platforms?
39. Can you please explain if Business/Organisation SaaS supports calendaring of events? 40. Can you please explain Business/Organisation SaaS scheduling and events service? 41. Can you please Business/Organisation SaaS emailing requirements?
42. Are there any limitations on creating Ad-Hoc reports?
- Do you need specific software installed on a computer?
- What is the reporting platform being used?
- What version?
- What is the process if we need a specific report generated?
43. How are training materials and services costs covered with feature upgrades?
- Could you please send across user manuals and or training material?
- Do you have eLearning modules? What format are they in? SCORM etc.
Service Termination/Exit Strategy
44. What happens in the event Your Organisation Name terminates the contract? a. Who owns the data?
- How and in what format will the data be returned to Your Organisation Name?
- What assistance is available to transfer/transition data if Your Organisation Name needs totransition data back продажа кондиционеров в могилеве in-house