1. February 22, 2010SaaS Valuation Criteriaby Liz Herbertfor Sourcing & Vendor Management Professionals Making Leaders Successful Every Day

2. For Sourcing & Vendor Management Professionals February 22, 2010 SaaS Valuation Criteria Key Considerations For Sourcing SaaS Strategically by Liz Herbert with Christine Ferrusi Ross, Elizabeth Rose, and Philipp KarcherExec ut i ve S u mma ryFirms are increasingly sourcing SaaS strategically for enterprisewide deployments that span mission-critical deployments email, customer support, and financial applications. Firms making SaaSdecisions of this magnitude should scrutinize vendors carefully across key dimensions relevant toSaaS and cloud security, privacy, backup, vendor viability, product road map but also weigh thetradeoffs versus finding a nimble, flexible, full-featured, fast deployment option that meets their needs.table o f Co n te n tsNOT E S & RE S OUR CE S 2 SaaS Continues To Appeal To Buyers AcrossForrester interviewed vendor and user Applications And Geographies companies, including Google, Hubspan, IBM SaaS Buyers Are Concerned With TCO And Risk(LotusLive), McAfee, NetSuite, and Workday. 7 Why SaaS Requires Unique Buying ConsiderationsRelated Research Documents Status, Challenges, And Near-Term Tactics For Key Criteria That Matter When Selecting A SaaS Cloud Services In Enterprise Outsourcing Deals Solution November 18, 2009 recommendations The ROI Of Software-As-A-Service10 For Smaller SaaS Vendors, Weight The July 13, 2009 Potential Value To Be Gained11 Supplemental Material TechRadar For Sourcing & VendorManagement Professionals: Software-As-A-ServiceMarch 12, 2009 2010, Forrester Research, Inc. All rights reserved. Unauthorized reproduction is strictly prohibited. Information is based on best availableresources. Opinions reflect judgment at the time and are subject to change. Forrester, Technographics, Forrester Wave, RoleView, TechRadar,and Total Economic Impact are trademarks of Forrester Research, Inc. All other trademarks are the property of their respective companies. Topurchase reprints of this document, please email clientsupport@forrester.com. For additional information, go to www.forrester.com. 3. 2 SaaS Valuation CriteriaFor Sourcing & Vendor Management ProfessionalsSaas continues to appeal to buyers across applications and geographiesSaaS adoption is still on the rise. Nearly a decade since the early roots of then-infant companies likesalesforce.com and NetSuite, SaaS is now becoming a mainstream choice in most categories. In 2009Forrester surveys showed: Increased adoption and expansion of existing deployments. Forrester has seen a steady upward tick in SaaS adoption over the past several years since introducing the question in its Business Data Services market surveys. Currently, approximately one-fifth of IT services buyers tell Forrester they use SaaS (see Figure 1). Of these, nearly one-half told us they were expanding their deployment in 2009. An additional 26% of respondents were considering or piloting SaaS. Perhaps most notably, very few firms are reducing or removing SaaS investments: only 2%. Growth on a worldwide scale. SaaS adoption has now spread throughout the globe (see Figure 2). Although its early roots were heavily in the US, UK, and Australia, in part due to the English-only offerings as well as connectivity issues in some parts of the world, SaaS is now a key deployment model across Latin America, China, India, the Middle East, and Africa as well as North America, Europe, and Asia Pacific. Although connectivity and localization issues have hindered its adoption in some emerging regions, its low upfront costs, ability to scale, and reduced need for infrastructure make it a strong choice over on-premise investments. SaaS use across a wide range of business and IT applications. SaaS continues to break down barriers appealing to buyers across a wide range of solutions. Notably, despite the long run that sales automation had at the top of the SaaS popularity list, categories like enterprise resource planning (ERP), content management, collaboration (which includes email), project- based solutions, and supply chain software have all surpassed it in 2009 (see Figure 3). This shows that SaaS has matured significantly not only are SaaS offerings available in these categories, but firms consider them viable alternatives to on-premise choices (see Figure 4).February 22, 2010 2010, Forrester Research, Inc. Reproduction Prohibited 4. SaaS Valuation Criteria 3 For Sourcing & Vendor Management ProfessionalsFigure 1 Firms Are Expanding Their Use Of SaaSWhat are your rms plans to implement or expand your use software-as-a-service (SaaS) in the next 12 months? SaaS is an application which you dont own,it is hosted remotely, and a monthly usage fee is paid. Expand or upgrade existing implementation9%Implementing or implemented11%Considering or piloting 26% Decreasing or removing 2% Not interested or dont know 52%Base: 370 IT services decision-makersSource: Enterprise Global Technology Adoption Survey, Asia Pacic, Latin America, Middle East,And Africa, Q1 200955950 Source: Forrester Research, Inc.Figure 2 SaaS Adoption Is Growing Worldwide Which of the following initiatives are likely to be your IT organizationsmajor technology-related themes for 2009?Adopting or increasing your use of software-as-a-service Critical/high priority Low priority Not on our agenda Dont knowLatin America42% 33%23%3% N = 262 Emerging Asia (China, India)41% 33% 19% 7% N = 259MEA/Russia39% 31%24% 5% N = 329 (Russia, UAE, South Africa)Europe (excluding Russia) 39%29% 25% 7% N = 717Asia Pacic (Japan, South Korea,35%33% 25% 7% N = 370 Singapore, Australia/New Zealand)North America32% 28% 36% 4% N = 1,560Base: Global enterprise and SMB budget decision-makers (percentages may not total 100 because of rounding)Source: Enterprise And SMB Global IT Budgets And Spending Survey, Q2 200955950 Source: Forrester Research, Inc. 2010, Forrester Research, Inc. Reproduction Prohibited February 22, 2010 5. 4 SaaS Valuation CriteriaFor Sourcing & Vendor Management ProfessionalsFigure 3 Firms Use SaaS Across A Broad Range Of ApplicationsFor which of the following software applications is your rm using software-as-a-service (SaaS)? Yes NoDont knowEnterprise resource planning (ERP) software42% 52% 6% Customer service and support software, eld service,42% 52% 6%help desk, eService, and contact center management) Content management software41%53% 6% Human capital management (HCM) software40%54% 6% Order management software40%54% 6% Spend management or supplier relationship management (SRM) software37%57% 6% Collaboration software 37%57% 6%Project-based solutions (PBS) software 33% 61% 6% Supply chain management (SCM) software 31%63% 6%Web 2.0 technologies such as blogs, wikis, and RSS 26% 68% 6%Product life-cycle management (PLM) software 25% 69% 6%Sales force automation (SFA) software23% 70% 6%Marketing automation software20% 74% 6% Software that supports an industry-specic process14% 80% 6% Other software 8% 86% 6% Base: 176 global IT services decision-makers(percentages may not total 100 because of rounding)Source: Enterprise Global Technology Adoption Survey, Asia Pacic, Latin America, Middle East,And Africa, Q1 200955950Source: Forrester Research, Inc.February 22, 2010 2010, Forrester Research, Inc. Reproduction Prohibited 6. SaaS Valuation Criteria 5 For Sourcing & Vendor Management ProfessionalsFigure 4 SaaS Buyers Have Many Choices Across Leading Categories CategoryExample SaaS vendorsERPFinancialForce.com, Glovia, Coda, Workday, Intacct, NetSuiteHCMUltimate Software, Workday, PlateauCRMRightNow Technologies, salesforce.com, SAP, NetSuite, Oracle Siebel CRM OnDemand, MicrosoftCollaboration Google, Microsoft, IBMs LotusLive, Ciscos Webex, Citrix(including email) Sales performance Xactly (and Centiv, which it acquired), Callidus On Demandmanagement IT service management HP, service-now, CA, BMCSecurity McAfee, Symantec, Google, Microsoft, HP, IBM, Websense, Scansafe, Zscalar SaaS integrationHubspan, Castiron, Informatica, Sterling Commerce Other Concur (travel and expense), Daptiv (project management)55950 Source: Forrester Research, Inc.SaaS Buyers Are Concerned With TCO And RiskSaaS buyers like the appeal of fast deployment, ability to substitute monthly costs for upfront costs(opex versus capex), and reduced dependence on internal IT resources (see Figure 5). They likethat SaaS, with its automatic upgrades, can quickly deliver features that on-premise solutions lack.And many firms believe that SaaS offers a lower overall cost. But some SaaS skeptics raise seriousconcerns about SaaS total cost of ownership (TCO), security, privacy, performance, integration, andfinding the solution they seek.(see Figure 6). 2010, Forrester Research, Inc. Reproduction ProhibitedFebruary 22, 2010 7. 6 SaaS Valuation CriteriaFor Sourcing & Vendor Management ProfessionalsFigure 5 Deployment Speed And TCO Drive SaaS Purchasing Decisions How important were the following in your rms decision to adopt software-as-a-service? Dont know or n/a1: Not at all important23 4 5: Very important3% Speed of implementation and deployment3%8% 28%24% 34% 6%Lower overall costs 2% 10% 19% 27%36%Gaining a feature or functionality that is not available2% 8% 13% 27%24%26% in a traditional, licensed software packageLack of in-house IT sta to maintain a traditional 2% 13% 8% 22% 31% 25% software solutionTo support a large number of mobile2% 13% 11% 26% 26% 22%and remote usersAbility to substitute upfront costs with regular 3% 13% 10% 28% 24%22%monthly payments Base: 176 IT services decision-makers (percentages may not total 100 because of rounding)Source: Enterprise Global Technology Adoption Survey, Asia Pacic, Latin America, Middle East,And Africa, Q1 200955950 Source: Forrester Research, Inc.Figure 6 SaaS Skeptics Are Concerned With TCO, Security, And PrivacyWhy arent you interested in software-as-a-service? Total cost concerns 36% Security or privacy concerns30% We cant nd the specic application we need23%Integration issues 23% Complicated pricing models 20% Were locked in with our current vendor 19% Network latency issues18%Lack of customization18%Application performance 16% Other reason19% Base: 194 IT services decision-makers(multiple responses accepted)Source: Enterprise Global Technology Adoption Survey, Asia Pacic, Latin America, Middle East,And Africa, Q1 200955950 Source: Forrester Research, Inc.February 22, 2010 2010, Forrester Research, Inc. Reproduction Prohibited 8. SaaS Valuation Criteria7For Sourcing & Vendor Management Professionalswhy saas requires unique buying considerationsMany clients ask Forrester whats different about SaaS versus other software or services purchases.Typical software buyers tell Forrester that criteria such as functionality, cost, service and support,and integration top their list of buying criteria (see Figure 7). While these criteria are still highlyimportant for SaaS purchasing, SaaS differs from tradition software in key ways such as: Greater dependency on a large customer base for survival and profitability. SaaS is built on the concept of multitenancy and economies of scale; as the client base of the SaaS provider grows, its cost to serve the next customer decreases (in theory). Therefore, a true SaaS model is more dependent than single-tenant models on a large subscriber base to succeed and to have funds available to reinvest in R&D to sustain the automatic upgrades clients have come to expect. Unlikely to be easily, cost-effectively run on-premise single instance. Software escrow has long been a tactic that firms have relied on to protect themselves from software vendor risk. However, because SaaS is typically built to run in a multiclient environment it would be much less practical to migrate a SaaS solution than a single-instance hosted solution to an on-premise or alternate provider environment. This means that SaaS escrow has limited practicality. While some may question the practicality of software escrow generally, SaaS escrow has much less chance of utility than software escrow in non-SaaS situations. Central point of attack for hackers. The multitenant nature of SaaS solutions means there is a central point of attack for security hacks to steal crucial information about bank accounts, customers, and more. However, while some potential SaaS buyers immediately perceive this as a negative it can sometimes be a positive because it forces SaaS providers to place extra emphasis on security. Some SaaS providers, like Google and salesforce.com, are the targets of countless attacks and security audits, which have resulted in stronger security than most on-premise solutions. Immaturity of the market shakeout and consolidation create risk. Despite SaaS nearly 10-year existence, the overall market is still plagued with growing pains. Vendor shakeout and consolidation run rampant, and there have even been a few failures. Many vendors are still small; only recently have larger companies like IBM, Microsoft, SAP, and Oracle entered the mix. And even within these larger firms SaaS has been plagued by stalled attempts and limited executive attention compared to on-premise alternatives. Lack of SaaS skills in IT talent pool and at service providers. SaaS surpassed early markers of maturity custom fields, custom tabs, custom objects in the earlier part of the decade, but IT skill sets and related training and certification programs have (expectedly) lagged. Firms taking advantage of enterprise caliber salesforce.com, Google, or Workday deployments will find they likely dont have staff in-house that have familiarity with these tools. Fortunately, a growing group of service providers do, and training programs will likely evolve.1 2010, Forrester Research, Inc. Reproduction Prohibited February 22, 2010 9. 8 SaaS Valuation CriteriaFor Sourcing & Vendor Management ProfessionalsFigure 7 Functionality And Cost Reign King Across Software Buy DecisionsHow important are the following criteria to your rm when selecting software?Dont know or n/a1: Not at all important 2 345: Very important3%Overall functionality25% 71% 1% Overall system cost5% 28%66% 1%Availability of service and support9% 36%53% 1% Ability to integrate with your rms9% 38%51% other systems3% Software pricing/licensing model1%14%38%44%References from other companies 2% 11% 32% 39%16% Ability to integrate with customers,partners, and suppliers systems1% 6% 17%29%30% 18% Software brand 6% 15% 35%33% 11%Availability as software-as-a-service 5% 22% 26%29% 13% 5% Base: 1,900 global IT services decision-makers (percentages may not total 100 because of rounding)Source: Enterprise Global Technology Adoption Survey, Asia Pacic, Latin America, Middle East,And Africa, Q1 200955950 Source: Forrester Research, Inc.Key Criteria That Matter When Selecting A SaaS SolutionBecause of the dependence on a SaaS provider and its customer base for survival, economies of scale,and crucial product investments key to the value most SaaS buyers expect, crucial factors in a SaaSsolution selection include: Vendor finances: profitability, cash, and investors. Many of todays leading SaaS vendors are small, but firms shouldnt disregard them outright based on that. They are also often unprofitable initially; SaaS subscription-based pricing model contributes to this. But buyers should be cautious to consider key factors: How much revenue does the provider generate annually? Is the provider particularly susceptible to currency fluctuation? If so, which currencies and why? If privately owned, who are the providers investors? What are their ties and backgrounds? Dedication to SaaS. Some SaaS vendors like salesforce.com, NetSuite, Google, and Workday are 100% dedicated to SaaS. Others like Microsoft, IBM, SAP, Oracle, and RightNowTechnologies offer multiple deployment options: SaaS, hosted, and/or on-premise. Like manyFebruary 22, 2010 2010, Forrester Research, Inc. Reproduction Prohibited 10. SaaS Valuation Criteria9For Sourcing & Vendor Management Professionals considerations, this is a tradeoff. Having a 100% SaaS focus means dedication of resources and typically more frequent product releases. These firms are also usually more nimble, more easily able to respond to market demand. However, firms with multiple deployment options offer flexibility to migrate between options, hybrid deployments, and sometimes options like Oracles private tenancy which is an ability to have a SaaS-like option yet retain higher degrees of control around certain key infrastructure elements. Customer base/subscriber base. An obvious question is how many SaaS customers the vendor has. This is particularly crucial since the economies of scale are a key part of SaaS survival. For most SaaS vendors, a few large SaaS customers are just as good for their economies of scales as several smaller ones as long as the end number of tenants or subscribers is similar. But dependence on a few large customers can be risky since losing one or more could be detrimental to profitability and ultimately survival. Also important is who or what kind of customers are on the application. Because a SaaS solution is typically designed with the idea of load balancing across peaks, an optimal capacity solution has a customer mix that taxes the solution at different peak times for example, some retail customers heavily using it on weekends and in holiday months and some services firms using it heavily during 9-to-5 hours. Otherwise, the system could be slow at peak times if all customers are on at the same time and capacity gets overloaded. Architecture. SaaS buyers often say that SaaS ability to get started quickly, excess capacity, and ability to tap into resources are high on the value drivers for investing in SaaS. This means that the underlying architecture and specifically a truly cloud-based architecture is crucial. A strong architecture allows firms to invest slowly with small pilots and grow incrementally over time. Poorly designed architectures can often be detected because vendors have minimum commitments that are high like 100 user minimums or higher. This can be a sign of a single tenancy design, which will reduce the resource flexibility and economy of scale benefits throughout the solution life cycle. Security and privacy. For security and privacy, companies must consider: data protection, identity management, vulnerability management, physical and personnel security, application security, incident response, and privacy measures.2 Firms should review the vendors data protection techniques for both data at rest and data in motion. Firms should ensure that the provider has adequate documentation for auditors and has achieved applicable certifications such as SAS 70 Type II. Firms should review the vendors authentication and access control procedure and ask if any third party (e.g., third-party service provider) may have access to the data or infrastructure and how. Firms should review the vendors architecture to ensure proper data segregation. Backup/redundancy. Firms should find out where their SaaS solution is hosted, where and how it is backed up. They should ask their provider about recovery time objective (RTO) the time 2010, Forrester Research, Inc. Reproduction Prohibited February 22, 2010 11. 10 SaaS Valuation Criteria For Sourcing & Vendor Management Professionalsto get data back after a failure and recovery point objective (RPO) time between backups,which translates into risk of data loss. Firms should also find out if there are partners that canoffer additional backup and recovery options if they are not satisfied with what their provideroffers.Road map for new functionality. One of the key drivers for SaaS investment is the upgrades.Firms frustrated with traditional on-premise upgrades usually costly, time-consuming, anddisruptive to users find that the more incremental SaaS upgrades deliver new features andfunctions multiple times per year with less disruption to users. Firms should find out howfrequently they should expect upgrades, how they take advantage of them (mandatory versus attheir convenience), and general categories where their SaaS provider plans enhancements. ManySaaS vendors are still working to catch up to established on-premise vendors in core areas butare also moving into new areas at the same time (salesforce.com continues to beef up sales forceautomation [SFA] while moving into content management; Workday continues to build outhuman capital management [HCM] while moving into financials).Implementation and support partners; plan to attract talent. Larger projects will require talent skilled in the SaaS solution. The skills are different than large on-premise projects: a lot less BASIS, Java, and SQL programming in favor of more point-and-click and business analyst work. But business process design, some programming, and integration work is still crucial to success. Some integrators are already building practices around leading SaaS applications Accenture, Deloitte, CSC, Capgemini, IBM, Infosys, Wipro, UST Global as well as SaaS specialists like Bluewolf, Astadia, Appirio, CoreMatrix Systems, and ModelMetrics. Beyond third-party skills, many firms seek to build their own talent. They should evaluate training and certification available from the providers as well as partners. Few providers have well-established programs in place today; some exist, and firms should expect to see more as SaaS continues to mature.Rec o mme n d a t i o n sfor smaller saas vendors, weigh the potential value to be gainedSoftware giants like SAP, Oracle, Microsoft, IBM, and CA now offer software-as-a-service in somecategories of their portfolio, but many of todays leading SaaS applications come from smaller,newer entrants. While sourcing executives should help their firms consider the tradeoffs as wellas set minimum requirements in key areas like security, they should also consider the potentialbenefits of smaller providers: Good deals for being an early (and possibly strategic) customer. Early customers have an opportunity to lock in good pricing. They can typically get extra discounts for paying their full subscription upfront; smaller providers can take advantage of the cash to invest in R&D and sales and marketing efforts. February 22, 2010 2010, Forrester Research, Inc. Reproduction Prohibited 12. SaaS Valuation Criteria11For Sourcing & Vendor Management ProfessionalsNimble, flexible, start-up mentality. While SaaS initiatives inside large companies are oftensubject to typical enterprise politics and therefore can move more slowly as a result, smallerSaaS vendors are usually able to quickly roll out new features, respond to customer demand,and innovate on product and services offerings.Chance to drive future product direction. Early clients will have the chance to influenceproduct direction in multiple ways. They can participate explicitly in various user groups andforums where they interact with the vendor. Often the vendor is small enough that feedbackto an account manager is actually heard or they may even have interactions with uppermanagement including the executive team. And finally, because the solution is SaaS, theway their users interact with the product may drive road map decisions; SaaS vendors oftencollect data on product usage and use it to drive development decisions.Supplemental MATERIALCompanies Interviewed For This DocumentGoogleMcAfeeHubspan NetSuiteIBM WorkdayEndnotes1 SaaS solutions are entering a new phase in their evolution, one in which companies view them as a strategic part of the software landscape and as increasingly pervasive across most application categories. No longer plain-vanilla solutions lacking customization, SaaS solutions are increasingly built on extensible platforms that allow firms to fit them to their specific business process needs ( la salesforce.coms Force.com and NetSuites NSBOS). With this growing sophistication, sourcing executives increasingly seek help from third- party services firms to navigate the SaaS landscape, technical implementation services, and ongoing service provider management. See the January 5, 2010, Understanding SaaS Systems Integrator Option report.2 Amid a downturn economy, organizations increasingly look to cloud computing to improve operationalefficiency, reduce headcounts, and help with the bottom line. But security and privacy concerns present astrong barrier-to-entry. In an age when the consequences and potential costs of mistakes are rising fast forcompanies that handle confidential and private customer data, IT security professionals must develop betterways of evaluating the security and privacy practices of the cloud services. An effective assessment strategymust cover data protection, compliance, privacy, identity management, secure operations, and otherrelated security and legal issues. The ultimate goal: Make the cloud service work like your own IT securitydepartment and find ways to secure and optimize your investments in the cloud. See the May 8, 2009, HowSecure Is Your Cloud? report. 2010, Forrester Research, Inc. Reproduction Prohibited February 22, 2010 13. Making Leaders Successful Every DayHeadquartersResearch and Sales OfficesForrester Research, Inc.Forrester has research centers and sales offices in more than 27 cities400 Technology Square internationally, including Amsterdam; Cambridge, Mass.; Dallas; Dubai;Cambridge, MA 02139 USA Foster City, Calif.; Frankfurt; London; Madrid; Sydney; Tel Aviv; and Toronto.Tel: +1 617.613.6000Fax: +1 617.613.5000For a complete list of worldwide locationsvisit www.forrester.com/about.Email: forrester@forrester.comNasdaq symbol: FORRwww.forrester.comFor information on hard-copy or electronic reprints, please contact Client Supportat +1 866.367.7378, +1 617.613.5730, or clientsupport@forrester.com.We offer quantity discounts and special pricing for academic and nonprofit institutions.Forrester Research, Inc. (Nasdaq: FORR)is an independent research companythat provides pragmatic and forward-thinking advice to global leaders inbusiness and technology. Forresterworks with professionals in 20 key rolesat major companies providingproprietary research, customer insight,consulting, events, and peer-to-peerexecutive programs. For more than 26years, Forrester has been making IT,marketing, and technology industryleaders successful every day. For moreinformation, visit www.forrester.com. 55950