Security. Security concerns have diminished in many CIOs’ minds. There have been no reported breaches at SaaS providers. “I used to be concerned about sending sensitive information out,” says EFI’s Do, “but then I realized I already send out payroll information, so I realized I could trust outside providers.” He verifies the vendors’ security plans, though, before granting that trust. Schwab prefers that its SaaS providers segregate its data onto separate storage hardware when critical information is involved, notes Hohenstein, although it will allow commingled storage in some cases. “Either way, we have stringent requirements on security,” he says.

But not everyone is so trusting. “We have not gone to a SaaS provider for applications that use sensitive information,” says TI’s Murphree. “We don’t want to give up control.” Risk management. CIOs should make sure that they demand the same auditing and control requirements from SaaS providers that they would of any outsourcer, including “safe harbor” provisions for ensuring data privacy, rights to the software and all data in case the vendor goes out of business, and the ability to audit the vendor’s controls (including the use of SAS-70 self-audits), says Gartner’s Desisto. “Certification processes are now standard, so it’s easier to work with a reputable company for external certification,” says Accenture’s Modruson. The trick, says EFI’s Do, is to find SaaS providers who understand this need. “The light bulb is not on as much as it should be, since most are smaller companies,” he says. Another precaution to take is to get the rights to the software should the vendor fail, so you can run it in-house until you find a new option, says Sapphire’s Perry. As part of that, make sure to get backups of the data stored by the SaaS provider.

The use of SaaS can also help reduce risk. For example, “there’s less risk in trying to deploy SaaS quickly than there is in investing a lot of money on internal resources, which are the scarcest resources I have,” notes MedImmune’s Young.

In some industries, SaaS providers can assume their customers’ risk. Many U.S. small banks, for example, use SaaS providers, such as Intuit’s Digital Insight division, for their Internet banking and wealth management platforms, notes Basil Blume, CIO of Colorado Capital Bank. Small banks don’t have the resources to meet all the regulatory and security needs for such software, so it makes sense for them to use firms that do, are audited by regulators and assume financial accountability in case of failures, he says. “We transfer the risk. There is a bit of premium to pay, but then I don’t need to keep those developers on staff either,” Blume notes.