The company regularly pushed out changes to its software, issuing a major feature release, which often encompassed more than a week of preparation, every month, and smaller bug fixes several times a week. The updates required patching the software on each of the physical servers in the company's data centers, an activity fraught with the potential for manual errors.

When Concur needed to expand its server capacity to match growing demand for its software-as-a-service (SaaS), the firm had to rush-order the computers, have them delivered to the proper data center, and configure them. The process generally took weeks, says Craig Baughn, vice president of Concur's hosting services.

"Three years ago, if I needed a server because of a capacity issue, we had to scramble around," he says. "There was a whole series of physical events that had to take place."

[For timely cloud computing news and expert analysis, see CIO.com's Cloud Computing Drilldown section. ]

That's a problem for a company that processes travel expense on behalf of 9,000 customers and 10 percent of the world's business travelers. So, beginning in 2008, Concur embarked on an internal program to embrace the core concepts of cloud computing for its data center. The company virtualized its data centers—no longer running its core applications on physical servers but on virtual machines—and focused on making its capacity elastic, expanding dynamically with the needs of its clients and internal groups.

"The owners (internal departments) of the products or the SaaS services don't always want to know the super technical nuts and bolts of the platform, but they do want to know that their requirements are delivered quickly, effectively, securely and with higher service levels," Baughn says.

Time, Cost and Compliance Benefits

The improvement has been dramatic, Baughn says. Errors have almost been eliminated in deploying updates to applications, with incidents caused by configuration mistakes down 85 to 95 percent. And spinning up additional capacity is a much faster process. "We have gone from weeks to days," he says.

So far, the move to a private cloud has paid off, he says. The company has already saved $1.7 million and expects a total savings of $7 million over three years, including staff savings. Because of the increased efficiency of the company's private cloud, the company avoided throwing more engineers at its problem.

"Bladelogic enabled us to re-allocate resources to other areas of the business because of the efficiency offered," Baughn says. "Without it, it is possible that we would need a handful more engineers than we have today to manage the release process...and we'd need a few more systems engineers if we hadn't embraced virtualization."

In addition, the company has a better handle on its nine major audits, which check its compliance with the usual suspect list of regulations, such as PCI, Sarbanes-Oxley and Graham-Leach-Bliley. The company uses reports from BMC's BladeLogic software to validate that changes required by compliance regulations have been made to all servers, both physical and virtual.

Public Cloud When Secure

"There is a learning curve associated with that as the virtual environment and some of the toolsets are different, so you need to build time to develop and implement best practices," he says. "We have also greatly increased the ability to deploy more quickly and add capacity on demand, but with that comes a greater responsibility to manage that capacity."

While Concur has focused on implementing cloud computing ideals inside its company, the IT staff has not ruled out using public cloud-computing services to help the firm save money in the future.

"We have not determined a best-practice approach as of yet," Baughn says. "In order for us to move forward here, we have to ensure that everything we do is as secure as if it were within our own private cloud."