Managed service providers sprout into an increasingly available option for greater IT outsourcing
By Collin Canright
It’s been a universal industry refrain for many years: Affordable access to current technology is a crucial competitive point for community banks, as it is with any financial services firm.
The challenge is even greater with today’s mobile consumers. As customers increasingly demand access to banking services anytime, anywhere, and on any device, community banks face more demand for technology solutions, requiring network, security and mobile capabilities.
For many community banks, hiring additional information technology staff is not an option. In any community banks, a portion of the “IT staff” often have non-IT duties as well. When push comes to shove, they serve customers rather than manage technology.
As a result, more community banks are looking to outsource more of their IT operations to managed service providers (MSPs). Unlike traditional value-added resellers and IT consulting firms, MSPs manage technology for the bank. In addition to selling hardware or software systems, MSPs perform the ongoing management and maintenance of those IT systems and infrastructures. MSPs typically use cloud-based systems, also called hosted IT services, to achieve efficiencies by sharing infrastructure across a number of clients.
The services a specific MSP provides varies depending on its business focus. Most managed service providers focus on routine technologies like telephone and email networks, which frees bank IT staff working with office systems. MSPs can manage internet access and network security, as well as mobile devices used by bank employees to access the internal network. Some MSPs can also manage bank-specific systems, such as mobile banking and core processing.
State Bank of Cochran, a $225 million-asset community banks in Cochran, Ga., uses an MSP to handle system upgrades and enhancements, which would otherwise be more costly if handled internally, says Leesa Anderson, the bank’s chief technology officer. “By using an MSP, we are able to leverage the benefit of an entire team of highly talented engineers, without having to hire them internally,” Anderson says. “We can also implement technologies offered by the MSP that would be cost prohibitive if we were to purchase, install and manage the hardware and software ourselves.”
Through MSPs, community banks can maintain more up-to-date software and hardware at lower costs, says Chuck Daniels, CEO of the Banking Infrastructure & Technology Services (BITS), an MSP in Camp Hill, Pa. Cost savings for community banks in using MSPs can vary depending on the state of a bank’s infrastructure and the software and hardware upgrades it needs. “Cost savings of 20 percent to 40 percent over what you are paying now is a good rule of thumb,” Daniels says.
Even so, cost savings can and should be documented in an MSP’s proposal, Daniels says. When evaluating an MSP, make sure that all costs and fees are included so you can compare the MSP cost to existing hardware, software, and staff costs.
MSPs can also potentially help either trim compliance costs and meet all of their IT regulatory and security requirements. Indeed, community bankers and service providers say regulatory considerations, as much as cost savings, are driving more banks to consider IT outsourcing through MSPs.
Concerns and considerations
On the other side of the outsource equation, MSPs introduce a level of operational risk into bank operations. Any time a bank outsources its technology—or even a customer service for that matter—it loses some control. Will the MSP maintain the service as well as your bank’s staff would? Will the MSP resolve issues as quickly as your staff would?
“The big concern for us is confidentiality and their financial stability,” says Paul Grindstaff Jr, network administrator at First State Community Bank in Farmington, Mo. When evaluating MSPs, community bankers stress that the most important consideration rests on financial industry experience. “Look for a vendor that has industry expertise,” adds Anderson.
Financial industry experience is particularly important because an MSP must understand the unique federal security regulations and compliance requirements required of banks. “They need to be up to speed on (bank) regulations and security needs,” Grindstaff says. “MSPs focused on financial institutions give us a second set of eyes to assist with compliance and security.”
In performing due diligence on an MSP, check its experience against guidelines issued by the Federal Financial Institutions Examination Council related to outsourcing information systems and technology services. The FFIEC addresses security standards, contracts, auditing, business continuity and other issues in its IT Examination Handbook.
Also, you must understand the nature of the cloud-based systems the MSP offers. Where do data actually reside? Does the MSP use a public or private cloud service? Given the security concerns, an MSP should be completely transparent on its cloud’s data storage, backup, and security infrastructure and policies.
Finally, remember that no matter what MSP your community bank might use and how much experience the company might have, your bank remains ultimately responsible for the safe and smooth operations, especially in the eyes of banking regulators.
As Anderson puts it, “Always remember that at the end of the day, the bank is still ultimately responsible for its own network. You will never be able to fully outsource responsibility.”
Collin Canright is a financial writer in Chicago.