Editor’s note: This is a compilation of two articles that originally appeared in TechRepublic’s ASP Informer TechMail. Subscribe, and you’ll receive the latest information on ASPs.

As you build your evaluation matrix for potential providers of hosted services, one of the criteria you may choose to add is certification. If you look at the current state of certification in the hosted provider market, however, you may not get an accurate picture of the company’s capabilities. In addition to several lesser-known certification efforts, three major vendors have stepped up to certify their hosting partners: Sun, IBM, and Microsoft. Let’s look at the nature and purpose of their certification programs.

The overall purpose of providing certification is to allow consumers to have the confidence that someone knowledgeable and trustworthy has looked at the provider and given his or her vote of confidence. But for the certification to have value, you have to know what that vote of confidence means. Does it mean that the hosting partner has installed its systems properly, has good operating procedures, has good operations management, and has reliability and redundancy built throughout its systems and procedures? Each of the major hosting certification vendors have their own spin.

The “single point in time” method
The IBM Certification program (called Hosting Advantage) is designed to certify companies that use IBM platforms or key e-business products and technology. It consists of an extensive self-assessment document followed by a two-day on-site review by an IBM audit and technology consulting team. The on-site review includes the current hosting environment as well as its operational procedures for availability, capacity planning, security, backup and recovery, systems management, performance, and customer support. Unfortunately, all the certification can hope to accomplish is to confirm that at a single point in time, all of these procedures and systems were in place—not that the procedures will be followed or that the systems will be maintained.

Sun’s SunTone certification attempts to do the same thing, except it’s focused on delivering applications using Sun hardware and the Solaris operating system. Neither Sun’s nor IBM’s certifications address cross-platform applications. Nor do they address the certifications or qualifications of the people who actually run the systems. Someone wanting to achieve certification could easily hire a top-end consulting firm to build and document their data center and then hire underqualified, low-paid Web monkeys to keep the systems operating.

In addition to the fact that these certifications don’t address the key element of “who the workers are,” they also don’t take into account “who the providers are.” The reviews don’t look at the quality and service levels of third-party connectivity providers. They also don’t account for practices of common partners like electricians, local loop installers, etc. Recently, one of these certified data centers allowed an electrician to add circuits in the middle of the day. It seemed harmless—until the electrician, while putting the cover back on the circuit box, hit the main breaker and shut down the data center. Since the electrical circuits were inside the backup protection systems, they weren’t able to keep the machines in the racks operating. No amount of certification can protect you from stupid mistakes.

Microsoft’s approach
The certification efforts of IBM and Sun are focused on running their hardware and software using processes that their own consultants have developed over several years of running high-availability systems. Microsoft, on the other hand, is in a difficult position when certifying its hosting partners. Since Microsoft doesn’t sell the underlying hardware, it’s at the mercy of either the vendor or the hosting partner’s infrastructure architect to make sure that the hardware is of sufficient quality.

Microsoft has attempted to narrow the gap in Windows 2000 by allowing it to be installed in such a way that it requires certified drivers to improve the overall reliability of the operating system. As more massive multiprocessor boxes (greater than 8) and applications that support them become available for Windows 2000, the intent of Windows 2000 Datacenter edition will be more obvious. By only releasing Datacenter through hardware vendors (Unisys, Fujitsu, IBM, Compaq, etc.), Microsoft has a way to tightly couple its operating system to the hardware and guarantee a higher degree of reliability.

But what does Microsoft do in the interim? Without having years of data center experience to market to its hosting partners, it did the next best thing: partnered with an organization that represents hundreds of “man-years” of data center experience. The IT Infrastructure Library (ITIL) provides consistent and comprehensive documentation of best practices for IT service management. Microsoft based the Microsoft Operations Framework (or MOF) on this service management library.

Whether or not your hosting partner is certified, it’s certainly worth asking if they’re aware of and follow the ITIL recommendations for best services practices. MOF adapts the ITIL framework and documentation to reflect best practices for creating a highly available, hosted Windows environment. Microsoft’s Gold Certified Hosting Partners are those who’ve passed self-assessments and on-site evaluations similar to those in the IBM and Sun certification programs. The Microsoft on-site examinations are much more rigorous and time consuming (and, of course, considerably more expensive than their counterparts). This means it will take longer to be a Microsoft-certified hosting center, and there will be fewer of them in the next 12 months.

Ask the right questions
The bottom line is this: At this point, all the certification programs combined have only a small number of certified data centers. With the number of ASPs being considerably higher, it’s likely that you’ll be deciding between multiple noncertified providers in the immediate future. For now, you should focus primarily on the most important elements of a successful hosting operation: people and process. Ask to see the process documentation for common operations like backup and recovery. Ask to see the product certifications of the engineers and developers who designed, deployed, and support the system. These are more likely to be indicators of potential success in the near term than a data center certification.

What’s your take?

Is ASP certification important? Or is the burden still on the customer to check out the ASP’s level of expertise? Share your thoughts by posting a comment below.