PREPARED FOR · 451 Research is a preeminent information technology research and advisory company. ... leaders of the digital economy. More than 100 analysts and consultants deliver

©COPYRIGHT 2017 451 RESEARCH. ALL RIGHTS RESERVED.

Choosing a Colocation Provider in SingaporeM A R C H 20 1 7

B L AC K & W H I T E PA P E R

P R E PA R E D FO R

2PREPARED FOR SINGTEL

About 451 Research451 Research is a preeminent information technology research and advisory company. With a core focus on technology innovation and market disruption, we provide essential insight for leaders of the digital economy. More than 100 analysts and consultants deliver that insight via syndicated research, advisory services and live events to over 1,000 client organizations in North America, Europe and around the world. Founded in 2000 and headquartered in New York, 451 Research is a division of The 451 Group.

© 2017 451 Research, LLC and/or its Affiliates. All Rights Reserved. Reproduction and distribution of this publi-cation, in whole or in part, in any form without prior written permission is forbidden. The terms of use regarding distribution, both internally and externally, shall be governed by the terms laid out in your Service Agreement with 451 Research and/or its Affiliates. The information contained herein has been obtained from sources be-lieved to be reliable. 451 Research disclaims all warranties as to the accuracy, completeness or adequacy of such information. Although 451 Research may discuss legal issues related to the information technology business, 451 Research does not provide legal advice or services and their research should not be construed or used as such.

451 Research shall have no liability for errors, omissions or inadequacies in the information contained herein or for interpretations thereof. The reader assumes sole responsibility for the selection of these materials to achieve its intended results. The opinions expressed herein are subject to change without notice.

About this paperA Black & White paper is a study based on primary research survey data that assesses the market dynamics of a key enterprise technology segment through the lens of the “on the ground” experience and opinions of real practitioners — what they are doing, and why they are doing it.

NEW YORK1411 Broadway New York, NY 10018 +1 212 505 3030

SAN FRANCISCO140 Geary Street San Francisco, CA 94108 +1 415 989 1555

LONDONPaxton House 30, Artillery Lane London, E1 7LS, UK +44 (0) 207 426 1050

BOSTON75-101 Federal Street Boston, MA 02110 +1 617 598 7200


B L AC K & W H I T E PA P E R | C H O O S I N G A CO LO CAT I O N P ROV I D E R I N S I N G A P O R E

Executive SummaryCloud (infrastructure as a service) has been in the headlines for several years, and the model has been adopted rapidly, leading to assumptions that many enterprises have shifted all workloads to cloud and no longer have on-premises infrastructure or leased colocation space. However, in our surveys, we have found that many enterprises have a relatively small percentage of workloads in IaaS public cloud and that on-premises facilities, colocation and off-premises private cloud (dedicated hosting), in addition to software as a service, remain essential deployment options for many firms. How should executives go about choosing providers that best suit their specific needs?In this report, we examine customer demand for datacenter space in Singapore and dis-cuss key criteria for selecting a colocation facility. We also provide recommendations for customers regarding what to look for when choosing among colocation providers.

K EY F I N D I N GS

� In our recent survey, 80% of respondents said their organization plans to increase spending on colocation in Singapore over the next year.

� The top driver for colocation in Singapore is the need for a regional/local presence due to network latency. Other key reasons include disaster recovery, to gain a secure connection to cloud providers, and to store data locally due to data regulations and/or compliance requirements.

� Key criteria for selecting a colocation provider include security capabilities, reliability, and network considerations such as carrier neutrality, choice of bandwidth providers, and connectivity to cloud providers.

M E T H O D O LO GY

The survey data used in this report was collected in October 2016 by 451 Research using telephone-based surveys to query 100 enterprises with colocation deployments in Singapore. The firms surveyed were from a variety of verticals, and had varying employee counts and revenue.



Enterprises Plan to Increase Use of Colocation Enterprises have needed space for their IT equipment ever since they’ve had IT. Today, some IT workloads may be run out of on-premises datacenter space, but others will be hosted off-site by a traditional hosting provider, and some put into a private/hybrid cloud or provisioned out of a public cloud service. Whatever its mode of delivery, every enterprise service is still associated with some type of physical datacenter space, and as data and processing requirements continue to grow, the need for datacenter space also grows.

Colocation (when an enterprise locates its IT equipment in datacenter space leased from a service provider) has been a key option for enterprise deployments, particularly for firms that want to retain their own IT equipment due to security concerns, the sensitive nature of data involved, regulatory requirements around that data, or because they have legacy applications that cannot be run in the cloud. Colocation is increasingly viewed as a strategic connection point between the two converging worlds of traditional enterprise IT and cloud.

Singapore has been a top market for colocation for the past several years. It is one of the most well-connected Asian coun-tries, with more than 15 active submarine cable systems landing on the island in three designated sites. There is good con-nectivity throughout the island, and dark fiber is available between datacenters. In addition, the Singapore government has been supportive of the datacenter industry by, for example, regularly making land and buildings available for datacenters in industrial parks. Power companies have been willing to work with datacenter operators to provide the large quantities of electricity needed. These factors, along with the strong legal system, political stability and low risk of natural disasters, continue to make Singapore an attractive datacenter location.

In our survey, leading public service agencies, financial services companies and service providers to organizations operat-ing in Singapore confirmed that colocation use was widespread and growing. Among those surveyed, colocation services accounted for up to 25% of the overall IT and facilities budget (including the cost of rented rack space, interconnect fees, etc.), and usage is forecast to increase in coming quarters. Roughly 75% of the organizations polled intend to make even more use of colocation services in 2017 than they have in years past, and they fully expect to increase their spending in this area. What’s driving this increased interest? And how should executives go about making business decisions about colocation?

In our quarterly surveys of 1,000 enterprises around the world (Voice of the Enterprise), we have found that, on average, firms have about 5% of their workloads off-premises in colocation, 40% of workloads off-premises in hosted private cloud/public cloud/hybrid cloud and 54% of workloads still on-premises (see Figure 1).

Figure 1: Workload LocationQ: What percentage of your organization’s applications are currently deployed in the following venues? (% shown is median) (n=515)

3.3%

4.8%

9.3%

14.1%

14.3%

24.0%

30.2%

Hybrid Cloud

Colocation

Purchase goods or services on a mobile app

SaaS Public Cloud

IaaS Public Cloud

On-Premises Private Cloud

On-Premises Non-Cloud

Source: 451 Research Voice of the Enterprise Cloud, Vendor Evaluations, 2016



However, although the percentage of applications in public cloud may be relatively high, the actual amount of data, compute, equipment, etc. in on-premises datacenters and colocation can be quite substantial. In Singapore, respondents noted that just over one-third of their IT budget was earmarked for IT facilities and colocation (see Figure 2).

Figure 2: IT Budget CategoriesQ: How is your Singapore IT and facilities budget distributed across the following categories? (This should add up to 100%). (n=100)

IT equipment (servers, storage, networking)

26%

12%

24%

9%

7%

9%

13%

Facilities equipment (racks, power, cooling)

Colocation

Software-as-a-Service (SaaS)

Staff costs

Shared/multi-tenant servers (public cloud)

Rented dedicated servers (hosted private cloud)

Source: Singapore Colocation Survey, October 2016

Our surveys show that enterprises plan to gradually shift a greater percentage of applications off-premises and into cloud, with a slight reduction in the percentage of applications in colocation. However, this does not mean that overall usage of colocation will decline. Even if applications are moved to cloud, the applications in colocation facilities may continue to grow in footprint and power usage. In our Singapore survey, we found that firms generally expected to increase their annu-al spending on colocation (see Figure 3).

Figure 3: Colocation Budget TrendsQ: How do you expect your organization’s spending on colocation services to change in 2017 compared to 2016? (n=100)

6%

Increase spend >50%

Increase by 26%-50%

Increase by 11%-25%

Increase by 6%-10%

Increase by 1%-5%

No change Decrease by 1%-5%

Decrease by 6%-10%

Decrease by 25%-50%

17%

13%

27%

17%15%

3% 1% 1%


Respondents also said they plan to increase their use of colocation for IT deployments, so the expected growth in colocation spending is due not only to the increasing space needed by current applications but also by new applications (see Figure 4).



Figure 4: Increased Use of ColocationQ: Will your organization increase your usage of colocation providers for upcoming IT deployments? (n=100)

No26%

Don’t Know1%

Yes73%


So why is there so much interest in colocation in Singapore? In our survey, the top driver reported was the need for regional/local presence due to network latency (see Figure 5). In our sample, 48% of the firms surveyed are headquartered outside of Singapore, and more than half of these firms are headquartered outside of Asia. For these companies, connections for their staff, suppliers and customers in Asia would be delayed and expensive if constantly routed back through headquarters in North America or Europe. In these cases, it makes sense to locate data in-region, and Singapore has been one of the top choices in Asia due to its location, legal system, political stability and available quality colocation space. In addition to latency, other key reasons respondents use colocation are for disaster recovery, to gain a secure connection to cloud providers, and to store data locally due to data regulations and/or compliance requirements.

Figure 5: Business Drivers of ColocationQ: What are the primary reasons your organization is considering increasing usage of colocation providers for IT deployments?

Please select all that apply. (n=100)

Other

Peering/Interconnection

Organization No Longer Wants to Own Datacenters

Require Regional/Local Presence due to Compliance

Disaster Recovery

Direction Connection to Cloud Providers

Require Regional/Local Presence due to Latency 63

54

54

53

50

36


We asked firms for additional clarity on their disaster-recovery (DR) strategy and setup and found that most respondents complete local backups of data regularly and also carry out regular remote backups; nearly 80% ship DR data to another physical recovery site (see Figure 6). About 64% of companies maintain their own DR site, which could be enterprise-owned or in a colocation facility, while 89% use a DR service provider for some components. Backup/DR is one task that enterprises are increasingly outsourcing – either to a managed services provider or to a colocation provider that can help to set up DR configurations and provide remote-hands services to the DR site. This is a crucial activity that, nevertheless, does not generate revenue for typical enterprises; therefore, companies may not want to devote highly skilled internal staff resources or in-house datacenter space to it.



Figure 6: Disaster-Recovery and Business-Continuity ConsiderationsQ: What precautions do you take to ensure application/systems availability and business continuity and recovery from any form of data

loss? (Select all that apply) (n=100)

We replicate VMs to cloud

We use cloud-based DRaaS

We store data to tape

We maintain our own DR site

We ship DR data to another physical site

We regularly test our DR/BC plans

We do local backups of data regularly

We carry out remote backups regularly 92

86

79

79

64

55

53

31




Selecting a Colocation ProviderWhat do enterprises look for in a colocation provider in Singapore? What should they look for? Respondents to our survey chose security capabilities as the top criterion (see Figure 7), followed by reliability, certifications (which help to prove reliability and also may be used for audits), carrier neutrality and choice of bandwidth providers, and whether a provider has sites in multiple geographies. In our quarterly global surveys of enterprises, security is also typically the number one concern, followed by redundancy of the facility and then network requirements. We will examine these criteria and some of the drivers behind them in more detail.

Figure 7: Criteria for Selecting a Colocation ProviderQ: Please rate how important the following criteria are for choosing a colocation provider, with 0 being ‘Not at all important’ and 10 being

‘Extremely Important.’ [randomized list] (n=100) (number shown is mean)

On-site remote hands

Location of the facility

Provider has multiple facilities across geographies

Choice of bandwidth providers

Colocation operator is also building owner

Personalized space

Direct connection to cloud services providers

Availability of cloud services

Carrier neutrality

Datacenter certifications

Reliability & redundancy of the facility

Security capabilities 9.7

9.7

9.4

8.7

8.7

8.7

8.4

8.3

8.1

8.1

7.3

7.3

S E L ECT I N G A CO LO CAT I O N P R OV I D E R : S ECU R I T YPhysical security of a datacenter site is a requirement for all customers, but particularly enterprise customers in regulated industries that must comply with various regulations that can impact where data is stored, how it is handled, and what physical security and procedures are required at the datacenter. For example, the Monetary Authority of Singapore has mandated that all financial institutions operating in Singapore comply with its Technology Risk Management Guidelines, which include a Threat and Vulnerability Risk Assessment (TVRA) for datacenters. Financial services datacenters in Singapore generally must also comply with ISAE 3402 (International Standard on Assurance Engagements rule) which documents internal controls used by service providers. Another certification is the PSB Information Security Management System certification, ISO27001, which specifies requirements for managing information security effectively and systematically. It includes more than 100 security controls that must be observed and audited. Some colocation providers in Singapore have brought TVRA, ISAE3402 and/or ISO27001-compliant colocation facilities online to meet these requirements.



Datacenter security is typically accomplished through the integration of three distinct security solution categories:

� Physical security requirements that address the datacenter environment.

� System controls that provide access control limits, intrusion detection, activity surveillance and investigative tools.

� Operational controls in the form of policies and procedures.

The key security requirement for all datacenters is to ensure that only authorized persons can access a datacenter site and the equipment contained within that site. High-level physical security in use in multi-tenant datacenter facilities often includes:

� A buffer zone around the building with controlled vehicle and building access.

� No exterior signage.

� Building entry limited to one main entrance plus a loading dock area.

� Exterior cameras to monitor parking lot, vehicle entrances and neighboring property.

� Raised-floor area that does not sit against exterior walls (building within a building).

� Enforced double- or triple-factor access control for the building and successive data areas (using cards, PINs, biometrics).

� Access systems to prevent ‘follow through’ and ‘pass back’ access (mantraps).

� Access restricted to those who maintain servers, infrastructure and facilities only.

� CCTV monitoring in all areas and CCTV records kept for a minimum of 90 days.

� All security guards and site employees subject to background checks.

� IT equipment separated from mechanical and electrical equipment.

� Regular security audits.

In addition to physical access controls, the process for provisioning datacenter facility access is important to many enterprises because this is an area frequently audited to ensure compliance. The security systems, personnel and operating procedures should be in place to provide operational coverage of: video surveillance; visitor management; intrusion detection; key and lock management; incident management and reporting; emergency communications; emergency response plans; remote video and alarm monitoring; and safety and security services.

Finally, interconnection services within a colocation facility can be used to provide secure access to the cloud services used by the enterprise. A dedicated, direct link to the cloud provider offers a more secure transport path compared to traversal over the public internet. We will discuss this in more detail when we discuss network considerations.

S E L ECT I N G A CO LO CAT I O N P R OV I D E R : R E L I A B I L I T YThe primary objective for any datacenter is to maintain the availability of the services being delivered by the IT equipment housed within the site. To this end, datacenters must continuously supply large amounts of electrical power and cooling capacity, as well as network access. Individual datacenters can achieve reliability through a combination of high-quality operational practices and redundant power, cooling and network elements.

Several standards exist for evaluating datacenter quality and reliability. The Uptime Institute (an independent division of The 451 Group) uses a four-tier ranking system as a benchmark for describing the availability that should be expected from a given datacenter. This rating system begins with Tier I datacenters, which offer a relatively low level of protection against external risks. Tier II and Tier III sites both offer levels of power, cooling and network redundancy with the difference being that Tier III sites have the ability to carry out maintenance on any component without affecting service. A Tier IV datacenter is fault-tolerant, meaning that even if an unplanned event occurs during maintenance, the datacenter should continue functioning. Note that both Tier III and Tier IV datacenter specifications require all IT equipment to have dual power inputs so that maintenance can be done on power components without having to shut off the IT equipment.

Best-in-class operation is crucial to reliability – various industry surveys have shown that as much as 70-80% of outages may be due to human error. In addition, even a fault-tolerant infrastructure design may be only as reliable as a Tier I or II facility if it is not maintained properly. In general, it is wise to work with providers that have a track record of operating facilities with low levels of unplanned outages. Prospective colocation customers should also ask to see providers’ maintenance records and obtain feedback from current customers of the facility on the providers’ operations and overall datacenter



reliability. There are few industry standards for operations, although The Uptime Institute recently established a Management and Operations Stamp that datacenter providers can achieve after their operations are checked and graded against a list of best practices.

Other datacenter standards include the ANSI/TIA-942 series and the BICSI list of best practices. The Singapore Infocomm Development Authority also offers a standard for business continuity and disaster recovery service providers – SS507. The SS507 standard specifies stringent requirements in the operation, monitoring, maintenance and upkeep of business-continuity and DR services. In our survey, Uptime, ISO27001 and ANSI/TIA were considered the most important certifications (see Figure 8).

Figure 8: Datacenter Certification PrioritiesQ: Which of the following certifications are most important to your organization when it comes to choosing a colocation service provider?

(Multiple Select) (n=96)

Uptime

SSAE16

PCI

TIA

ISO27001

86

85

85

74

70

A highly fault-tolerant datacenter costs more to build due to the need for redundant power and cooling components, as well as changes to the layout and structure of the building. Therefore, colocation customers need to determine what level of redundancy is required for their applications and how much they are willing to pay for increased reliability.

S E L ECT I N G A CO LO CAT I O N P R OV I D E R : CO N N ECT I V I T YColocation and wholesale datacenters are either carrier-neutral or carrier-specific. A carrier-neutral datacenter offers access to several network providers. This typically results in lower network connectivity prices for customers because of competi-tion between carriers. However, this is balanced by typically higher rent for space in carrier-neutral datacenters compared with carrier-specific facilities.

Network density is loosely defined as the number of networks that are reachable from within a facility through direct fiber cross-connects. Most enterprises desire a moderate level of network density in a facility. That means that they require three to four carriers or providers. Network quality, the services on offer and available bandwidth are also issues. In many carrier datacenters, there is only one network available – the carrier’s own. In other facilities that are theoretically carrier-neutral, there may be few carriers available. Datacenter operators should be willing to disclose exactly which carriers have ‘lit’ their datacenters and the variety of services that they are able to offer.

While enterprises may not need 30 carriers, they do need the carriers present to offer a full range of telecommunications services. Customers should check whether the available networks offer only internet transit or are willing to peer. Are dark fiber or optical wavelength services available? Is SS7-trunking capability offered? Some providers may offer Ethernet-based services (e.g., internet transit and peering), but not voice services or optical products such as dark fiber. It is also important to know whether on-demand connectivity is available – how quickly additional capacity can be supplied if needed and whether short-term or variable contracts are available – for example when moving large amounts of data to the cloud or when backing up data from one site to another.

In addition, there are many situations in which it is necessary for colocation customers to connect to other datacenters – e.g., for disaster recovery/backup purposes, to expand their deployments, or to connect more easily (and sometimes at lower cost) with carriers, customers, partners or service providers. Prospective customers should ask whether the provider offers connectivity to other sites (via dark fiber or lit services), how much capacity is available and at what cost.

It is also increasingly important for enterprises to access cloud providers. Cloud providers have been responding to customer



demand for better connectivity options by offering the ability to let customers use a dedicated physical connection to access the cloud service from a nearby point of presence. A dedicated, direct link to the cloud provider offers a more secure transport path with latency and bandwidth that are more consistent with deterministic routing. Depending on the point of interconnection, performance may be suitable for latency-sensitive workloads that could not be run over a public internet link. The use of a private connection can sometimes save money because the traffic doesn’t have to be routed over the ISP’s connection to the internet; instead, it is sent direct to the cloud provider. Cloud providers such as AWS will also charge a lower outbound data transfer rate compared to transfer over public internet links. Finally, a variety of hybrid service models can be implemented, including a mix of public and hosted private cloud services, over the same secure, dedicated link. This allows for more flexibility in placing different workloads on resources that have an appropriate price/performance profile.

Some colocation datacenters provide these direct connections to cloud providers, and/or other cloud connectivity options via a cross-connect or a cloud exchange platform. For some customers, it is preferable to have cloud services actually hosted in the same datacenter as colocation (see Figure 9). In Singapore, 20% of respondents said they thought it was very important that cloud be hosted at the same datacenter; 40% of those respondents work for technology firms and 25% for banks. Technology firms likely base some of their own services on cloud infrastructure and, therefore, want the infrastructure to be in the same datacenter, perhaps for latency reasons, to be able to access multiple cloud providers from one location, or to be able to confirm to customers where their data is stored.

Figure 9: Importance of Shared Datacenter Colocation/Cloud Hosting

Q: How important is it that cloud services be hosted in the same datacenter as your colocated IT infrastructure equipment? (n=100)

Somewhat important41%

Not very important36%

Not at all important3% Very important

20%



ConclusionsSingapore is one of the top datacenter markets in Asia and is likely to remain so, given continued strong customer demand (most of the firms we surveyed plan to increase spending on coloca-tion in Singapore over the next year). Demand comes from local enterprises, particularly financial services firms, as well as companies headquartered outside of Singapore that need to store data in Asia for latency reasons or to comply with data-sovereignty requirements. When selecting a co-location provider, prospective customers need to weigh various criteria against one another: se-curity processes and infrastructure required, cost, redundancy, network density, and the ability to connect to cloud providers. Fortunately, there is a wide variety of facilities and providers available in Singapore, so customers should be able to find an option that suits their needs and budget.

RECOMMENDATIONS

Enterprises should carefully evaluate each application to determine the best infrastructure location for it. For exam-ple, if usage is unpredictable and a flexible level of resources will be needed, using public cloud infrastructure may be the best choice. If a high level of data security and auditability are required, on-premises or colocation solutions may be more appropriate. For some applications or business functions, it may also make sense to use a mix of in-frastructure options (putting elements in both public and private cloud, for example).

When evaluating colocation vendors, customers should carefully evaluate each provider’s operational practices (controls, policies and procedures), as well as the security measures and redundancy of the facility. Providers that have practices in place to satisfy compliance standards are likely to be well run and may be a better choice, even for customers that are not in regulated industries.

The more highly redundant the infrastructure of a facility is, the higher the cost to build that facility. Prospective customers should evaluate what downtime of an application would cost the business in order to determine what level of resiliency in a datacenter is appropriate for those applications and at what price.

Documents

PREPARED FOR · 451 Research is a preeminent information technology research and advisory company. ... leaders of the digital economy. More than 100 analysts and consultants deliver