Choosing a Colocation Provider in Singapore

About this paper A Black & White paper is a study based on primary research survey data that assesses the market dynamics of a key enterprise technology segment through the lens of the on the ground experience and opinions of real practitioners what they are doing, and why they are doing it. About 451 Research 451 Research is a preeminent information technology research and advisory company. With a core focus on technology innovation and market disruption, we provide essential insight for leaders of the digital economy. More than 100 analysts and consultants deliver that insight via syndicated research, advisory services and live events to over 1,000 client organizations in North America, Europe and around the world. Founded in 2000 and headquartered in New York, 451 Research is a division of The 451 Group. 2017 451 Research, LLC and/or its Affiliates. All Rights Reserved. Reproduction and distribution of this publication, in whole or in part, in any form without prior written permission is forbidden. The terms of use regarding distribution, both internally and externally, shall be governed by the terms laid out in your Service Agreement with 451 Research and/or its Affiliates. The information contained herein has been obtained from sources believed to be reliable. 451 Research disclaims all warranties as to the accuracy, completeness or adequacy of such information. Although 451 Research may discuss legal issues related to the information technology business, 451 Research does not provide legal advice or services and their research should not be construed or used as such. 451 Research shall have no liability for errors, omissions or inadequacies in the information contained herein or for interpretations thereof. The reader assumes sole responsibility for the selection of these materials to achieve its intended results. The opinions expressed herein are subject to change without notice. NEW YORK 1411 Broadway New York, NY 10018 +1 212 505 3030 SAN FRANCISCO 140 Geary Street San Francisco, CA 94108 +1 415 989 1555 LONDON Paxton House 30, Artillery Lane London, E1 7LS, UK +44 (0) 207 426 1050 BOSTON 75-101 Federal Street Boston, MA 02110 +1 617 598 7200 2

Executive Summary Cloud (infrastructure as a service) has been in the headlines for several years, and the model has been adopted rapidly, leading to assumptions that many enterprises have shifted all workloads to cloud and no longer have on-premises infrastructure or leased colocation space. However, in our surveys, we have found that many enterprises have a relatively small percentage of workloads in IaaS public cloud and that on-premises facilities, colocation and off-premises private cloud (dedicated hosting), in addition to software as a service, remain essential deployment options for many firms. How should executives go about choosing providers that best suit their specific needs? In this report, we examine customer demand for datacenter space in Singapore and discuss key criteria for selecting a colocation facility. We also provide recommendations for customers regarding what to look for when choosing among colocation providers. KEY FINDINGS In our recent survey, 80% of respondents said their organization plans to increase spending on colocation in Singapore over the next year. The top driver for colocation in Singapore is the need for a regional/local presence due to network latency. Other key reasons include disaster recovery, to gain a secure connection to cloud providers, and to store data locally due to data regulations and/or compliance requirements. Key criteria for selecting a colocation provider include security capabilities, reliability, and network considerations such as carrier neutrality, choice of bandwidth providers, and connectivity to cloud providers. METHODOLOGY The survey data used in this report was collected in October 2016 by 451 Research using telephone-based surveys to query 100 enterprises with colocation deployments in Singapore. The firms surveyed were from a variety of verticals, and had varying employee counts and revenue. 3

Enterprises Plan to Increase Use of Colocation Enterprises have needed space for their IT equipment ever since they ve had IT. Today, some IT workloads may be run out of on-premises datacenter space, but others will be hosted off-site by a traditional hosting provider, and some put into a private/hybrid cloud or provisioned out of a public cloud service. Whatever its mode of delivery, every enterprise service is still associated with some type of physical datacenter space, and as data and processing requirements continue to grow, the need for datacenter space also grows. Colocation (when an enterprise locates its IT equipment in datacenter space leased from a service provider) has been a key option for enterprise deployments, particularly for firms that want to retain their own IT equipment due to security concerns, the sensitive nature of data involved, regulatory requirements around that data, or because they have legacy applications that cannot be run in the cloud. Colocation is increasingly viewed as a strategic connection point between the two converging worlds of traditional enterprise IT and cloud. Singapore has been a top market for colocation for the past several years. It is one of the most well-connected Asian countries, with more than 15 active submarine cable systems landing on the island in three designated sites. There is good connectivity throughout the island, and dark fiber is available between datacenters. In addition, the Singapore government has been supportive of the datacenter industry by, for example, regularly making land and buildings available for datacenters in industrial parks. Power companies have been willing to work with datacenter operators to provide the large quantities of electricity needed. These factors, along with the strong legal system, political stability and low risk of natural disasters, continue to make Singapore an attractive datacenter location. In our survey, leading public service agencies, financial services companies and service providers to organizations operating in Singapore confirmed that colocation use was widespread and growing. Among those surveyed, colocation services accounted for up to 25% of the overall IT and facilities budget (including the cost of rented rack space, interconnect fees, etc.), and usage is forecast to increase in coming quarters. Roughly 75% of the organizations polled intend to make even more use of colocation services in 2017 than they have in years past, and they fully expect to increase their spending in this area. What s driving this increased interest? And how should executives go about making business decisions about colocation? In our quarterly surveys of 1,000 enterprises around the world (Voice of the Enterprise), we have found that, on average, firms have about 5% of their workloads off-premises in colocation, 40% of workloads off-premises in hosted private cloud/ public cloud/hybrid cloud and 54% of workloads still on-premises (see Figure 1). Figure 1: Workload Location Q: What percentage of your organization s applications are currently deployed in the following venues? (% shown is median) (n=515) On-Premises Non-Cloud 30.2% On-Premises Private Cloud 24.0% IaaS Public Cloud 14.3% SaaS Public Cloud 14.1% Purchase goods or services on a mobile app 9.3% Colocation Hybrid Cloud 4.8% 3.3% Source: 451 Research Voice of the Enterprise Cloud, Vendor Evaluations, 2016 4

However, although the percentage of applications in public cloud may be relatively high, the actual amount of data, compute, equipment, etc. in on-premises datacenters and colocation can be quite substantial. In Singapore, respondents noted that just over one-third of their IT budget was earmarked for IT facilities and colocation (see Figure 2). Figure 2: IT Budget Categories Q: How is your Singapore IT and facilities budget distributed across the following categories? (This should add up to 100%). (n=100) Staff costs Software-as-a-Service (SaaS) 9% 13% 26% IT equipment (servers, storage, networking) 7% Shared/multi-tenant servers (public cloud) 9% 12% Facilities equipment (racks, power, cooling) Rented dedicated servers (hosted private cloud) 24% Colocation Source: Singapore Colocation Survey, October 2016 Our surveys show that enterprises plan to gradually shift a greater percentage of applications off-premises and into cloud, with a slight reduction in the percentage of applications in colocation. However, this does not mean that overall usage of colocation will decline. Even if applications are moved to cloud, the applications in colocation facilities may continue to grow in footprint and power usage. In our Singapore survey, we found that firms generally expected to increase their annual spending on colocation (see Figure 3). Figure 3: Colocation Budget Trends Q: How do you expect your organization s spending on colocation services to change in 2017 compared to 2016? (n=100) 27% 17% 13% 17% 15% 6% 3% 1% 1% Increase spend >50% Increase by 26%-50% Increase by 11%-25% Increase by 6%-10% Increase by 1%-5% No change Decrease by 1%-5% Decrease by 6%-10% Decrease by 25%-50% Source: Singapore Colocation Survey, October 2016 Respondents also said they plan to increase their use of colocation for IT deployments, so the expected growth in colocation spending is due not only to the increasing space needed by current applications but also by new applications (see Figure 4). 5

Figure 4: Increased Use of Colocation Q: Will your organization increase your usage of colocation providers for upcoming IT deployments? (n=100) Don t Know 1% No 26% Yes 73% Source: Singapore Colocation Survey, October 2016 So why is there so much interest in colocation in Singapore? In our survey, the top driver reported was the need for regional/ local presence due to network latency (see Figure 5). In our sample, 48% of the firms surveyed are headquartered outside of Singapore, and more than half of these firms are headquartered outside of Asia. For these companies, connections for their staff, suppliers and customers in Asia would be delayed and expensive if constantly routed back through headquarters in North America or Europe. In these cases, it makes sense to locate data in-region, and Singapore has been one of the top choices in Asia due to its location, legal system, political stability and available quality colocation space. In addition to latency, other key reasons respondents use colocation are for disaster recovery, to gain a secure connection to cloud providers, and to store data locally due to data regulations and/or compliance requirements. Figure 5: Business Drivers of Colocation Q: What are the primary reasons your organization is considering increasing usage of colocation providers for IT deployments? Please select all that apply. (n=100) Require Regional/Local Presence due to Latency 63 Direction Connection to Cloud Providers Disaster Recovery Require Regional/Local Presence due to Compliance Organization No Longer Wants to Own Datacenters 54 54 53 50 Peering/Interconnection 36 Other Source: Singapore Colocation Survey, October 2016 We asked firms for additional clarity on their disaster-recovery (DR) strategy and setup and found that most respondents complete local backups of data regularly and also carry out regular remote backups; nearly 80% ship DR data to another physical recovery site (see Figure 6). About 64% of companies maintain their own DR site, which could be enterpriseowned or in a colocation facility, while 89% use a DR service provider for some components. Backup/DR is one task that enterprises are increasingly outsourcing either to a managed services provider or to a colocation provider that can help to set up DR configurations and provide remote-hands services to the DR site. This is a crucial activity that, nevertheless, does not generate revenue for typical enterprises; therefore, companies may not want to devote highly skilled internal staff resources or in-house datacenter space to it. 6

Figure 6: Disaster-Recovery and Business-Continuity Considerations Q: What precautions do you take to ensure application/systems availability and business continuity and recovery from any form of data loss? (Select all that apply) (n=100) We carry out remote backups regularly 92 We do local backups of data regularly 86 We regularly test our DR/BC plans We ship DR data to another physical site 79 79 We maintain our own DR site 64 We store data to tape We replicate VMs to cloud 55 53 We use cloud-based DRaaS 31 Source: Singapore Colocation Survey, October 2016 7

Selecting a Colocation Provider What do enterprises look for in a colocation provider in Singapore? What should they look for? Respondents to our survey chose security capabilities as the top criterion (see Figure 7), followed by reliability, certifications (which help to prove reliability and also may be used for audits), carrier neutrality and choice of bandwidth providers, and whether a provider has sites in multiple geographies. In our quarterly global surveys of enterprises, security is also typically the number one concern, followed by redundancy of the facility and then network requirements. We will examine these criteria and some of the drivers behind them in more detail. Figure 7: Criteria for Selecting a Colocation Provider Q: Please rate how important the following criteria are for choosing a colocation provider, with 0 being Not at all important and 10 being Extremely Important. [randomized list] (n=100) (number shown is mean) Security capabilities 9.7 Reliability & redundancy of the facility Datacenter certifications 9.7 9.4 Carrier neutrality Choice of bandwidth providers Provider has multiple facilities across geographies On-site remote hands Location of the facility Availability of cloud services Direct connection to cloud services providers 8.7 8.7 8.7 8.4 8.3 8.1 8.1 Colocation operator is also building owner Personalized space 7.3 7.3 SELECTING A COLOCATION PROVIDER: SECURITY Physical security of a datacenter site is a requirement for all customers, but particularly enterprise customers in regulated industries that must comply with various regulations that can impact where data is stored, how it is handled, and what physical security and procedures are required at the datacenter. For example, the Monetary Authority of Singapore has mandated that all financial institutions operating in Singapore comply with its Technology Risk Management Guidelines, which include a Threat and Vulnerability Risk Assessment (TVRA) for datacenters. Financial services datacenters in Singapore generally must also comply with ISAE 3402 (International Standard on Assurance Engagements rule) which documents internal controls used by service providers. Another certification is the PSB Information Security Management System certification, ISO27001, which specifies requirements for managing information security effectively and systematically. It includes more than 100 security controls that must be observed and audited. Some colocation providers in Singapore have brought TVRA, ISAE3402 and/or ISO27001-compliant colocation facilities online to meet these requirements. 8

Datacenter security is typically accomplished through the integration of three distinct security solution categories: Physical security requirements that address the datacenter environment. System controls that provide access control limits, intrusion detection, activity surveillance and investigative tools. Operational controls in the form of policies and procedures. The key security requirement for all datacenters is to ensure that only authorized persons can access a datacenter site and the equipment contained within that site. High-level physical security in use in multi-tenant datacenter facilities often includes: A buffer zone around the building with controlled vehicle and building access. No exterior signage. Building entry limited to one main entrance plus a loading dock area. Exterior cameras to monitor parking lot, vehicle entrances and neighboring property. Raised-floor area that does not sit against exterior walls (building within a building). Enforced double- or triple-factor access control for the building and successive data areas (using cards, PINs, biometrics). Access systems to prevent follow through and pass back access (mantraps). Access restricted to those who maintain servers, infrastructure and facilities only. CCTV monitoring in all areas and CCTV records kept for a minimum of 90 days. All security guards and site employees subject to background checks. IT equipment separated from mechanical and electrical equipment. Regular security audits. In addition to physical access controls, the process for provisioning datacenter facility access is important to many enterprises because this is an area frequently audited to ensure compliance. The security systems, personnel and operating procedures should be in place to provide operational coverage of: video surveillance; visitor management; intrusion detection; key and lock management; incident management and reporting; emergency communications; emergency response plans; remote video and alarm monitoring; and safety and security services. Finally, interconnection services within a colocation facility can be used to provide secure access to the cloud services used by the enterprise. A dedicated, direct link to the cloud provider offers a more secure transport path compared to traversal over the public internet. We will discuss this in more detail when we discuss network considerations. SELECTING A COLOCATION PROVIDER: RELIABILITY The primary objective for any datacenter is to maintain the availability of the services being delivered by the IT equipment housed within the site. To this end, datacenters must continuously supply large amounts of electrical power and cooling capacity, as well as network access. Individual datacenters can achieve reliability through a combination of high-quality operational practices and redundant power, cooling and network elements. Several standards exist for evaluating datacenter quality and reliability. The Uptime Institute (an independent division of The 451 Group) uses a four-tier ranking system as a benchmark for describing the availability that should be expected from a given datacenter. This rating system begins with Tier I datacenters, which offer a relatively low level of protection against external risks. Tier II and Tier III sites both offer levels of power, cooling and network redundancy with the difference being that Tier III sites have the ability to carry out maintenance on any component without affecting service. A Tier IV datacenter is fault-tolerant, meaning that even if an unplanned event occurs during maintenance, the datacenter should continue functioning. Note that both Tier III and Tier IV datacenter specifications require all IT equipment to have dual power inputs so that maintenance can be done on power components without having to shut off the IT equipment. Best-in-class operation is crucial to reliability various industry surveys have shown that as much as 70-80% of outages may be due to human error. In addition, even a fault-tolerant infrastructure design may be only as reliable as a Tier I or II facility if it is not maintained properly. In general, it is wise to work with providers that have a track record of operating facilities with low levels of unplanned outages. Prospective colocation customers should also ask to see providers maintenance records and obtain feedback from current customers of the facility on the providers operations and overall datacenter 9

reliability. There are few industry standards for operations, although The Uptime Institute recently established a Management and Operations Stamp that datacenter providers can achieve after their operations are checked and graded against a list of best practices. Other datacenter standards include the ANSI/TIA-942 series and the BICSI list of best practices. The Singapore Infocomm Development Authority also offers a standard for business continuity and disaster recovery service providers SS507. The SS507 standard specifies stringent requirements in the operation, monitoring, maintenance and upkeep of businesscontinuity and DR services. In our survey, Uptime, ISO27001 and ANSI/TIA were considered the most important certifications (see Figure 8). Figure 8: Datacenter Certification Priorities Q: Which of the following certifications are most important to your organization when it comes to choosing a colocation service provider? (Multiple Select) (n=96) Uptime ISO27001 86 85 TIA 85 SSAE16 74 PCI 70 A highly fault-tolerant datacenter costs more to build due to the need for redundant power and cooling components, as well as changes to the layout and structure of the building. Therefore, colocation customers need to determine what level of redundancy is required for their applications and how much they are willing to pay for increased reliability. SELECTING A COLOCATION PROVIDER: CONNECTIVITY Colocation and wholesale datacenters are either carrier-neutral or carrier-specific. A carrier-neutral datacenter offers access to several network providers. This typically results in lower network connectivity prices for customers because of competition between carriers. However, this is balanced by typically higher rent for space in carrier-neutral datacenters compared with carrier-specific facilities. Network density is loosely defined as the number of networks that are reachable from within a facility through direct fiber cross-connects. Most enterprises desire a moderate level of network density in a facility. That means that they require three to four carriers or providers. Network quality, the services on offer and available bandwidth are also issues. In many carrier datacenters, there is only one network available the carrier s own. In other facilities that are theoretically carrier-neutral, there may be few carriers available. Datacenter operators should be willing to disclose exactly which carriers have lit their datacenters and the variety of services that they are able to offer. While enterprises may not need 30 carriers, they do need the carriers present to offer a full range of telecommunications services. Customers should check whether the available networks offer only internet transit or are willing to peer. Are dark fiber or optical wavelength services available? Is SS7-trunking capability offered? Some providers may offer Ethernet-based services (e.g., internet transit and peering), but not voice services or optical products such as dark fiber. It is also important to know whether on-demand connectivity is available how quickly additional capacity can be supplied if needed and whether short-term or variable contracts are available for example when moving large amounts of data to the cloud or when backing up data from one site to another. In addition, there are many situations in which it is necessary for colocation customers to connect to other datacenters e.g., for disaster recovery/backup purposes, to expand their deployments, or to connect more easily (and sometimes at lower cost) with carriers, customers, partners or service providers. Prospective customers should ask whether the provider offers connectivity to other sites (via dark fiber or lit services), how much capacity is available and at what cost. It is also increasingly important for enterprises to access cloud providers. Cloud providers have been responding to customer 10

demand for better connectivity options by offering the ability to let customers use a dedicated physical connection to access the cloud service from a nearby point of presence. A dedicated, direct link to the cloud provider offers a more secure transport path with latency and bandwidth that are more consistent with deterministic routing. Depending on the point of interconnection, performance may be suitable for latency-sensitive workloads that could not be run over a public internet link. The use of a private connection can sometimes save money because the traffic doesn t have to be routed over the ISP s connection to the internet; instead, it is sent direct to the cloud provider. Cloud providers such as AWS will also charge a lower outbound data transfer rate compared to transfer over public internet links. Finally, a variety of hybrid service models can be implemented, including a mix of public and hosted private cloud services, over the same secure, dedicated link. This allows for more flexibility in placing different workloads on resources that have an appropriate price/performance profile. Some colocation datacenters provide these direct connections to cloud providers, and/or other cloud connectivity options via a cross-connect or a cloud exchange platform. For some customers, it is preferable to have cloud services actually hosted in the same datacenter as colocation (see Figure 9). In Singapore, 20% of respondents said they thought it was very important that cloud be hosted at the same datacenter; 40% of those respondents work for technology firms and 25% for banks. Technology firms likely base some of their own services on cloud infrastructure and, therefore, want the infrastructure to be in the same datacenter, perhaps for latency reasons, to be able to access multiple cloud providers from one location, or to be able to confirm to customers where their data is stored. Figure 9: Importance of Shared Datacenter Colocation/Cloud Hosting Q: How important is it that cloud services be hosted in the same datacenter as your colocated IT infrastructure equipment? (n=100) Not at all important 3% Very important 20% Not very important 36% Somewhat important 41% 11

Conclusions Singapore is one of the top datacenter markets in Asia and is likely to remain so, given continued strong customer demand (most of the firms we surveyed plan to increase spending on colocation in Singapore over the next year). Demand comes from local enterprises, particularly financial services firms, as well as companies headquartered outside of Singapore that need to store data in Asia for latency reasons or to comply with data-sovereignty requirements. When selecting a colocation provider, prospective customers need to weigh various criteria against one another: security processes and infrastructure required, cost, redundancy, network density, and the ability to connect to cloud providers. Fortunately, there is a wide variety of facilities and providers available in Singapore, so customers should be able to find an option that suits their needs and budget. RECOMMENDATIONS Enterprises should carefully evaluate each application to determine the best infrastructure location for it. For example, if usage is unpredictable and a flexible level of resources will be needed, using public cloud infrastructure may be the best choice. If a high level of data security and auditability are required, on-premises or colocation solutions may be more appropriate. For some applications or business functions, it may also make sense to use a mix of infrastructure options (putting elements in both public and private cloud, for example). When evaluating colocation vendors, customers should carefully evaluate each provider s operational practices (controls, policies and procedures), as well as the security measures and redundancy of the facility. Providers that have practices in place to satisfy compliance standards are likely to be well run and may be a better choice, even for customers that are not in regulated industries. The more highly redundant the infrastructure of a facility is, the higher the cost to build that facility. Prospective customers should evaluate what downtime of an application would cost the business in order to determine what level of resiliency in a datacenter is appropriate for those applications and at what price. 12