CIO, Cloud, Opinion

The Cloud, Hosted, or On-premises: The Many Options for the SMB CIO

Whether it’s considered a blessing or a curse, CIOs today have a multitude of options at their disposal when it comes to running workloads.  In general, there are four options:

  • On-premises – physical server.
  • On-premises – virtual machine.
  • Off-premises – hosted.
  • Off-premises – cloud.

Over the past decade, the issue of whether to run on-premises workloads on physical hardware vs. virtual infrastructure has become pretty easy for organizations to assess, with the majority of new workloads being run inside virtual machines.  That said, there are still a good number of applications deployed on physical hardware.

When the deployment decision is down to just physical vs. virtual, CIOs and their technical staff can almost always make a quick determination as to where to run the workload.  Once off-premises options are thrown into the mix, however, the decision becomes a bit more complex.

When it comes to managing IT, SMBs and small midmarket firms have pretty unique challenges.  Even though they may run fewer systems, these firms must maintain IT portfolios that look much like the portfolios from their larger enterprise brethren.  Moreover, they have to do so with fewer people.  As such, IT staffers in these spaces often need to have a wider variety of skill sets, which may mean that they can’t get as deep into a particular area as would be possible with more people.  As a result, CIOs in SMBs tend to be creatures of caution and, if possible, like to forgo custom development efforts in favor of off-the-shelf solutions.

In another part of this article series, I outlined some of the services that organizations operate along with advice on what to move to the cloud and what to keep on-premises.  I think that the rules are a bit different for SMBs, for the reasons that I outlined above.  For these entities, focus on the business is critical, but it’s often overtaken by the need to constantly feed and care for the technology environment.  As such, smaller organizations can sometimes lose out on many of the business-facing benefits that can come from IT.

For SMBs, one of the first services that I believe should be moved to the cloud is email and calendaring.  Office 365 has proven to be a solid performer and provides just about all of the capabilities of the full on-premises Exchange but without some of the hassle that comes from having to manage the Exchange infrastructure.  Administrators can still use tools like PowerShell and a web console to manage Office 365 and Office 365 can be configured to use local Active Directory for authentication.  In that way, organizations retain control of the authentication and authorization component of the service.

This brings me to item number two for the SMB: Authentication.  Simple answer:  Keep it local.  It’s too important to push off anywhere else.

I could simply go down a list of services and make a recommendation, but instead, I’ll provide some general guidance for the SMB with regard to where to run services.  There are five questions that the CIO should ask to make a determination as to where to run services.

Question #1

Do I have the staff to run the service in-house?  As mentioned, SMB IT departments are often staffed by generalists rather than people with deep specializations in any one area.  This is not a knock on these departments; it’s simply reality.  If a CIO is bringing in a service that is going to require skills that are not present in the department, that CIO must decide whether to add the skills through training or new staff or, if the potential is there, ask if someone else (i.e. a cloud or hosting provider) can better support the service.

Question #2

Does the service require significant hands-on needs?  Some services simply require a lot of hands-on support.  This kind of effort can be expensive to outsource, so a CIO may make the decision that training or hiring makes the most sense in this situation.

Question #3

Would (or does) running the service in-house damage my ability to support the rest of the IT portfolio?  Any time something new is added to the portfolio, something has to change.  Either support for something else needs to decrease or resources need to be added to cover the new service.  If a new service is going to seriously disrupt your existing portfolio and you’re not able to hire staff to manage the new service, your best bet may be to push that service to an outside provider.

Question #4

Does this service require more HA or DR need that we currently have in-house?  A whole lot of SMBs don’t have backup systems that are as robust as they should be nor do they have critical items such as generators that can keep workloads running even when disaster strikes.  Those kinds of items can carry big price tags, so if a new service requires truly high levels of availability or recovery, an outside partner may be the best option.

Question #5

Can my current environment support the service to appropriate levels?  CIOs have spent years building out robust virtual environments, but that doesn’t mean that they’re ready for anything that’s thrown at them.  In some cases, the cost to add additional infrastructure simply isn’t worth the capital investment, so CIOs may make the choice to move to the outside.


SMBs can be unique animals in the IT space.  They can be exciting places to work, but carry significant challenges not always faced by their bigger brothers.  These differences often force CIOs to think a bit differently about how services might be deployed.