When an organization identifies the need for a new incident management software application, a common question is, “Should we build it ourselves, or should we source an off-the-shelf product?”
You have to start by assessing how complex your requirements are and the level of resources that will be required to meet them. Simple data capture is often seen as acceptable, and it may well be… until a past incident needs to be reviewed or an investigation must be launched. Without the broad search and investigation functionality of a comprehensive (and proven) incident management solution, an organization exposes itself to potential litigation and financial impact.
So, accepting that powerful, robust and scalable incident management software is preferred, what’s the best way to acquire it?
To build an effective solution from scratch, one or more developers must commit a significant amount of their time to the project, and the investment required for several months of research and development can quickly add up, especially if it’s done in conjunction with other projects. Factor in the post-development enhancements, bug fixes and support, and the IT costs are multiplied. Of course, if the developer(s) that built the internal solution decides to leave the company, an entirely new set of challenges ensues. What about changes in technology? What happens a few years down the road, when operating environments evolve and updates are required?
The other option is to buy an off-the-shelf solution. With software like Perspective by PPM 2000, many years of research and development by subject matter experts and seasoned developers have produced a world-class—and proven—solution. Perspective comes complete with full implementation, configuration and training in addition to technical support, bug fixes and upgrades, all included with its software support plan. Economies of scale allow for Perspective to be delivered affordably, with all of the functionality a comprehensive security and investigations team would require. Combine that with the SAS70 Type II certified hosting environment that PPM provides as part of our SaaS (Software as a Service) model, and the answer to build vs. buy becomes very clear.
When contemplating the build vs. buy question, ask yourself:
- Do we have the skills internally to create the system we need, including requirements, architecture, user interface design, documentation, etc.?
- Can we dedicate someone from the security team to act as the subject matter expert, guiding the developers through the incident management process and the scoping out of the requirements?
- Can the system be developed, tested and implemented in the required timeline? What are the consequences if the timeline isn’t met?
- How much will it cost us to build something internally? Have we considered all of the associated expenses and risk factors?
- Who will provide product support for an internal system? Who will fix bugs and issue updates?
- Do we need the application to integrate with any of our other systems? How do we ensure that type of flexibility? Who will build the integrations with future systems?
Although the build option may initially seem to be the most cost-effective choice, when all short and long-term considerations are made, building is rarely the best answer. Why reinvent the wheel, especially when it has already been created, mastered and is offered affordably? In the end, starting from scratch doesn’t make a lot of sense, whether you’re talking about wheels or incident management.
—Daryn Duliba, Account Manager