Gordon Peterson, the director of IT for the city of Carlsbad, Calif., raised some eyebrows at Microsoft when he started asking questions about how they did security.
Carlsbad wanted to outsource the management of its e-mail system, so it created a Request for Proposal (RFP) and sent it to Microsoft. The RFP asked some questions that Microsoft never had to answer before regarding how it terminated employees and how it vetted new employees. Carlsbad's concern was that it was relying on an outside vendor to manage municipal communications, and security was a top concern.
Peterson was faced with the decision to maintain the system in-house, outsource it or have it fully hosted. Peterson's conclusion was that Microsoft was able to afford a greater level of protection than his small 20-person IT shop and it would make more sense to have it fully hosted by Microsoft. Peterson did a Return on Investment (ROI) analysis and determined that it would cost $330k to have Microsoft manage e-mail, $390k to have it outsourced and $500k to manage it in-house.
Another nice benefit with having Microsoft manage e-mail is that since its solution is in the cloud, it doubles as part of a disaster recovery plan. Microsoft mirrors its service to a second site in Virginia, providing additional protection.
Other questions that Peterson addressed: how do they get their data back at the end of their contract? How do they add options as the company grows?
In my opinion, this is a great example of an organization that's doing the right things. Carldbad asked the tough questions that other people don't normally ask, positioning itself for growth and covering itself for contract termination.