Business technology leaders find themselves in something of a cloud computing deluge, showered by vendor marketing, new services, and even CEO questions about their "cloud strategy." Much of the exuberance centers on the kind of computing-by-the-hour service that Amazon.com and others sell but most enterprises are only starting to ponder.

Amid the lofty aspirations, few have noticed just how powerful and grounded a force software as a service has become. The impact that SaaS will have on IT organizations is profound, and as business technology leaders, we need to ensure that our companies are ready for it.

While SaaS shifts software deployment and maintenance burdens to the service provider, freeing up resources for other projects, IT is at the mercy of the provider for availability, data security, regulatory compliance, and other key issues. Outages will halt business, and poor response times will hamper productivity. SaaS apps aren't just a nice-to-have. Three-fourths of companies using SaaS consider application services extremely or critically important to their organizations, according to our InformationWeek Analytics survey of 281 business technologists, including 131 who now use SaaS. About one-third describe their SaaS apps as mission critical.

Despite that importance, too many IT leaders treat SaaS ad hoc. Of those using SaaS, 59% say it's a tactical point solution, and only 32% consider it part of their long-term strategy. CIOs will get the most from SaaS by making it part of an overall enterprise architecture. We'll spell out nine key areas an effective SaaS strategy must address.

Why is SaaS on such a roll? Surprisingly, the No. 1 reason is speed to implementation--37% of SaaS users cite it as a major driver. As companies come out of the recession, with pent-up demand for new capability and often smaller IT staffs, this factor could become even more important. Speed is followed by capital expense savings, cited by 28% of survey respondents, and operational expense savings, cited by 25%.

SaaS isn't universal. But among the 47% of our respondents who use it, SaaS has moved far beyond sales force automation and CRM. Human resources, Web presence, e-mail, service desk, collaboration, financial, and backup apps all are used by a fourth or more of SaaS customers. At my firm, Fusion PPT, a boutique federal consulting firm with staff working mostly at client sites, we use SaaS for 100% of our business server applications. From invoice, billing, and time sheets to sales pipeline management to e-mail, we don't own a single server or software license.

We went with SaaS for the main reasons the survey respondents are: quick setup and reduced capital costs. But another benefit, which will be increasingly powerful, is employee demand for mobility. SaaS will force IT organizations to make more apps securely accessible outside their corporate environment, be it remote offices, on the road, via a smartphone, or from a home PC. The demand for remote access may outpace IT's ability to deliver apps on a variety of platforms. For browser-based SaaS apps, mobile access is the name of the game.

For the half of survey respondents that haven't moved to SaaS, security's one of the biggest barriers: 39% cite it as a major obstacle. However, only slightly fewer cite the fact that they still don't know much about SaaS. Perhaps the fervor over cloud computing is overshadowing the education about simple software as a service. Data ownership is also a big obstacle, with 31% citing it as a reason they're not using SaaS. In speaking with SaaS vendors, they say security, privacy, and portability are the three objections they hear most. Portability will likely be one of the biggest worries this year, as companies pour more data into these apps and, having gained some SaaS experience and seen the growing number of choices, start switching providers.

9 Keys To SaaS Strategy

SaaS strategy is getting short shrift--perhaps because it's often being forced on IT. Among SaaS users, only 37% say the IT organization is the primary driver to use it; 54% say another C-level exec or line of business is behind it.

SaaS should be on the table any time a new IT-driven capability is brought into the company, and IT should have a clear framework for evaluating and operating it. In developing that SaaS strategy, teams should address these nine key areas.

1. Select the right provider. All SaaS vendors aren't created equal, so it's critical to select the one that best meets your business and technical requirements. Just because SaaS looks easy and cheap to get started, don't forgo your rigorous up-front analysis of features and capabilities. It may be simple enough to end a monthly SaaS contract, but not so much to extract the data and start over. Look beyond capabilities to also focus on security, reliability, backup, and data integrity and portability.

2. Sign the right contract. A company's needs evolve over time. How flexible is the contract and platform you're utilizing? How does pricing change as users are added or removed, or as usage changes? Your experience working with outsourcers will be of great help here. Watch for any commitments of time or usage levels. Carefully work out exit terms as well--if you want to cancel, are there fees involved? That leads to our next point.

3. Have a detailed exit strategy. If you do cancel, can you get your data back, and in a form that you can use? How about your customizations? Often, there are costs involved to transfer your data out of the SaaS environment. This will become one of the biggest questions around SaaS in the coming year, as companies put increasingly vital information into these platforms, in increasingly large quantities. So make sure you have a plan to move data when you want to change providers, or bring the solution back in-house. For example, our consulting firm avoids SaaS offerings that charge based on bandwidth usage, so that we won't be charged if we ever needed to export our data to another service.

4. Manage the relationship. Your usage levels will likely dictate the costs, so your organization must do consistent monitoring and evaluation to determine if the provider is meeting your needs. Many companies aren't set up to do this kind of monitoring, so it's a skill they need to enhance with more SaaS use. About three-fourths of SaaS users rely on the vendor to manage the performance of SaaS apps, our research finds.

5. Create a contingency plan. With SaaS, we haven't left the concept of five nines behind. While satisfaction levels are high for SaaS, IT must have a backup plan for apps that can't go down or data that can't be lost. It's critical to classify the type of data you need to back up. The SaaS provider should also provide tools for you to extract data. We perform a weekly full data export from Salesforce.com, so we have a local copy of all of our data.

6. Dig deep on interoperability and integration. Understand in detail what type of integration exists with your other applications. Don't assume your vendor has experience even with integrations you consider obvious--say, between an HR system and your payroll service provider. Do you need to use an API or Web services, or a middleware product, or even a third-party SaaS integration service? This is one pitfall of treating SaaS as a point solution. Few applications are effective in a silo, so you must ensure that your SaaS apps communicate with other online or conventional software. Indeed, half of the SaaS users we surveyed have those apps integrated with other internal applications, and another 28% will within 18 months.

7. Agree on IT's role in supporting the product. While conventional software support such as patching an operating system and deploying a security update isn't required, someone still has to add users, change passwords, create workflow, do screen designs, and perform other tasks. If someone has a problem using a SaaS-based HR time-sheet app, should he call IT or his HR person? If the move to SaaS is driven by a group outside the IT organization, there may be an expectation that IT doesn't need to be involved. That should be an explicit conversation. It may make sense, but if business stakeholders end up performing these tasks, it takes time away from performing their core functions.

8. Get senior executive support and involvement. If an application service is performing a critical business function, make sure the top leadership understands the benefits and risks of SaaS. The last thing you want is for an outage or data access problem to catch people by surprise. If an outage hits, you want them to already know what you can control (your relationship with the SaaS vendor) and what you can't (everything else about the app).

9. Align to the company objectives. Does the company have a goal to reduce capital spending, or shorten the time to deliver services? SaaS must be considered in that broader mission.

How To Keep SaaS Humming

Customers are generally pleased with SaaS apps, as 60% of survey respondents say they're performing the same as or better than conventional apps. And companies are continuing to invest in SaaS. While only 13% of customers today spend more than 20% of their IT budget on SaaS, within 18 months more than one-third will spend that much of their budget. And the fact that 78% of survey respondents have integrated or plan to integrate SaaS apps into other business applications shows a commitment to SaaS as part of an overall business architecture.

But the big challenge has only begun. As companies move to a mix of internally built custom applications, packaged on-premises applications with custom configurations, SaaS applications, and other types, it becomes much more difficult to understand the risks associated with application changes. It's ultimately up to the IT organization to ensure that this federated architecture keeps running, even if it doesn't control many of the components.

What will likely change in the coming years is how IT organizations manage and monitor the health and performance of SaaS apps. Today, many are passive, with nearly three-fourths of survey respondents relying on vendors' performance information. In the future, organizations will do more of their own SaaS performance monitoring, just as they would for any other application. And the best ones will monitor it not at an IT level, but in terms of end-user performance. End users won't call the SaaS provider if they have performance problems; they'll call the IT service desk.

Monitoring isn't easy, though. Using conventional management tools, it's hard to distinguish SaaS traffic from other forms of company Internet usage. Without deep packet analysis, IT staffers don't have the local ability to determine whether the service is up and running, or if a user's problem is caused by a local network or Internet failure. Even with packet analysis, there's no visibility into the performance problems caused inside the walls of the SaaS vendor. The price of SaaS will be less transparency, and reliance on vendors for some performance data. This trade-off could be unacceptable to some companies.

IT teams will also have to closely monitor bandwidth available between the user and the server, since that link will be increasingly critical. Caching mechanisms that enhance performance are worth considering, as retaining content and data locally will reduce the need to contact the SaaS server, if users access the same data.

Another looming challenge for business technology leaders will be deciding which apps lend themselves to SaaS. ERP's an unlikely candidate--executing some complex business functions with SaaS will take just as much effort as with on-premises apps, especially if IT teams are trying to replicate very specific business functionality.

CRM tops our list for SaaS use, and mobility will only strengthen that case. HR apps, our No. 2, seem poised for growth. For nearly a decade, I watched HR teams struggle with tasks such as applicant tracking, benefits, and other core functions. With HR SaaS, we had the functionality up and configured in a few hours. Use of business intelligence SaaS is low today (16% of survey respondents are using it), but it's the highest in terms of planned adoption over the next 18 months (20%). As more vendors provide APIs and Web services to let SaaS apps share data, companies will explore how combining that data with online analysis could improve decision making.

While the number and scope of SaaS offerings are growing, they're still limited compared with most conventional offerings. Typically, there's only one large player in a SaaS area, surrounded by startup competitors. So if you're unhappy with your current SaaS provider, you may have few alternative options.

The greatest force in the coming year may be conventional software applications offered in a variety of platforms--on-premises, or in the cloud. Microsoft is winning customers to its SaaS-based Exchange, and the company promises to roll out an online version of Office this year, though with some features removed. Many companies won't mind getting less online. When we began using the SaaS version of QuickBooks, we noticed that some features were missing, but we coped without them. It will be a difficult balancing act for vendors to offer world-class enterprise products in both environments, each with a very different business model.

It's similar to the balancing act facing IT organizations. They'll need to learn new skills and craft a new strategy that lets them integrate their legacy infrastructure with a fast-growing portfolio of SaaS apps.

Michael Biddick is president and CTO of Fusion PPT, a consulting and IT services firm. Write to him at [email protected].