"We tested nine or 10 different options before selecting one, but now we have to evaluate all the vendors again. It's a perpetual process," he says.
Before switching users over to a new application, McBride asks vendors to show him their next release or a viable product roadmap. "If they can't do that, we won't sign on with them," he says. He also solicits input from business leaders about which apps would work best. One department wanted to use Tableau to chart commercial analytics. McBride's team tested it, bought seats and then added it to the backup schedule, something that wouldn't happen if the department operated the application outside of IT.
McBride encourages users to explore new apps that can help them do their jobs better and is ready to kill off even SaaS apps that are unpopular, unproductive or require too much support. "I'm not worried about secure data being exposed by users trying out SaaS programs. He considers 2% of corporate data to be extremely confidential IP; it requires multiple points of authentication to access and is audited for access during the process.
In fact, sometimes McBride himself will find a better app and ask department leaders if they'd like to try it. He says SaaS makes it easy to always use the best tool for the job.
What you can't see...
IT executives must have access to all technology-related invoices to be able to make an informed decision to buy, sell or hold.
Invoices give unmatched insight into licenses, maintenance plans and redundancy. Paired with traditional assessment tools such as application access statistics and vulnerability assessments, IT executives can make informed decisions about which applications to keep or retire.
For instance, Needham Bank's Gordon realized via invoices that his team was using multiple backup tools, including Symantec Backup Exec and Veeam. "They provide the same functionality and we only need one," he says, adding they settled on Backup Exec.
"CTOs need to have invoices come across their desk, be responsible for billing and be cognizant of application costs," he says. "It's very easy for an organization to spend money on two or three products that do the same thing." In addition to the support issues, this can mean the enterprise can't claim the vendor's licensing discount for multiple seats.
Gordon says he's fortunate to be in the highly regulated financial industry because it forces him to keep tight control over his application portfolio. But even in the span of a year, application sprawl or abandonment can occur.
"We'll suspect an application is going unused and log in to see that it has had 400 patches pending a reboot and all the services have stopped. Yet no one has called looking for the application," he says. Luckily, once unused applications are retired, because the environment is virtualized, all underlying resources, including CPU and storage, can be immediately absorbed back into the shared enterprise pool.
Invoices don't show everything, though, as Gordon found. His employees were using a freeware PDF creator. However, adware started to creep in and degrade the user experience. He explained the performance degradation and the security risk to company executives and received the go-ahead to purchase a licensed software package that does the same thing.
In most cases, AMAG Pharmaceuticals' McBride says, his users will approach him about buying and replacing applications. But as a safety net, he does receive invoices for review and has a close relationship with accounts payable.
If he spots or is alerted to an application he wasn't aware of, he approaches the user or department and suggests that they go through IT to improve the application experience. Benefits of doing business with IT include single sign-on (because IT adds approved apps to its Okta identity-management system), backups on Google Drive to easily save data and IT will often find a corresponding iOS app for simplified mobile access. These carrots, he says, make it compelling to work with IT instead of going around them.
He also doesn't consider applications an all-or-nothing proposition. Sometimes he can enable a department to keep an app, but after evaluating actual usage, reduce the number of seats. "If only two people ever log in, we don't need licensing for 20 seats," he says.
Gordon agrees that IT has to get creative in dealing with application portfolio bloat. He says something as simple as asking marketing if they need a specific font license for a limited time only, or if it's truly required in perpetuity, can save money and storage space.
But he adds there are some battles you just can't win. "Everybody has different ways to do the same thing. Even though we spot inefficiencies, in the end it's not our place to manage other people's productivity. We just have to protect the data going into and coming out of those apps," he says.