Search Results for: NS0-404 Schulungsunterlagen 🩱 NS0-404 Fragen&Antworten 🍕 NS0-404 Zertifikatsfragen 🚋 ➠ www.itzert.com 🠰 ist die beste Webseite um den kostenlosen Download von ⮆ NS0-404 ⮄ zu erhalten 🦗NS0-404 Fragen Antworten

Posted
By

Let’s quickly revisit the scenario we’ve been following through our first two installments. That is, you are a CIO faced with a decision on whether or not to enter into an “enterprise” or an “unlimited” license arrangement with a major software publisher. With the first installment, we explored the scope of the deal (“What does “enterprise” or “unlimited” really mean?“). And, with the second installment we discussed the prospect of a long-term relationship with the publisher (“Do we really want to be doing business with this publisher?“).

Let’s assume you’ve gotten yourself a little more comfortable with the idea of the deal after looking at your team’s responses to the first two questions. Even so, there are additional risks to understand and address, which brings us to the third question:

“Does the deal reflect and account for the long-term nature of the arrangement and relationship with this publisher?”

There are two facets to be explored in answering this question. One facet is realizing the rightful expectation of getting better pricing than you would for a short-term relationship (or series of shorter term engagements). The other is making sure the deal is suitably structured for a long-term relationship.

The fourth installment of this series looks at the question “Am I getting a good deal?” from a price perspective.  In exploring that question we will touch on some of the pricing risks specific to an enterprise and unlimited licensing arrangement. Suffice it to say, an important consideration is whether   you will actually achieve the more attractive pricing rightfully expected in long term arrangement.

Now let’s talk about the second facet:

It should go without saying (though, surprisingly, it is often not the case) that these business arrangements should be structured (and have terms, including pricing) that will stand the test of time. That is, they should reflect the long-term nature of the relationship and the likelihood of change.

Why so important? The short answer is things inevitably change … for you, for the publisher and in the industry in general.  And the longer the term the more likely change will occur.

There are any number of changing circumstances that you ultimately may need to consider.  The potential list is long and the solutions and risk mitigation measures vary. Here are just of few examples.

Publisher or Industry-Driven Changes

·      Changes in the Publisher’s Business Strategy: The publisher may be acquired, may stop doing business, may sunset an application, may replace a product with a new (likely more expensive) one or may sell a product to another publisher. Your up-front due diligence (as discussed in question two) may help identify or offer opportunities to contain these risks, but in a long-term relationship this can (and often does) happen. Poison pills and “functionality” use rights can protect you to some extent, but at a minimum you must protect your continued use and support rights. 

· Changes in Support Offerings: This may include changes to the scope of the support offering or changes in the price for support. There are some protections a customer can pursue. For example:

o    Customers typically can secure the right to “not purchase” annual support for an entire license grant without losing perpetual use rights for that license grant. However, these rights are often subject to tight limitations.

o    Fee “freezes” and increase caps can be negotiated.

o    Customers also can negotiate limitations on changes to the support offering.

As a practical matter, however, these measures offer only modest protections.  The leverage proposition is tipped in favor of the publisher because the customer has few, if any, alternative sources of support.  You should try to obtain as many protections as you can when you make the purchase and then, at a minimum (a) make sure you fully understand the publisher’s ability to change its support offering (in the “fine print”) and (b) determine whether or how these changes could impact the economics of the deal.

· Changes in Law: A change in law has the potential to alter the method of support, the economics and even, in some cases, the efficacy of the system or   product (or one of its components). The risk is even more acute given the long term nature of these engagements. As a result, customers should, at a minimum, try to build in sufficient exit rights as an ultimate back-stop for this risk.

· Publisher Insolvency:  This is a risk with in any transaction, but more acute when the product is running an important component of your business – potentially for a long time. The typical measure is a source code escrow, which may not offer the optimal solution (it can be expensive and cumbersome). If an escrow is used, the key is obtaining escrow terms and release triggers that are reasonable and offer a meaningful opportunity to secure the source code when needed.  

Customer-Driven Changes (two examples)

· Customer Changes in Control:  Another entity acquires the customer or a customer business unit, or a business is divested. There are a variety of protections to consider in this area.  A few examples include: (1) obtaining a pre-agreed right to assign the license (or an allocated portion thereof) to the successor enterprise; (2) addressing use rights during transition and ongoing support; and (3) avoiding or limiting poison pills and analogous terms many publishers pursue if you are acquired.  

· Price Protection: From a long-term perspective, there are two primary aspects of price that should be considered:

Growth: If your company is on a growth path, the size of an enterprise agreement must be structured to accommodate that growth.   The unlimited deployment term usually lasts only three or four years. So what is the price for additional use rights that are required after the unlimited deployment term? Price holds, for example, are a typical protection. However, you should be cautious of the conditions that are attached to them, including sunset provisions and the requirement of continuous support payments.  

Schedules Slip or Actual Deployment Falls Below Initial Estimates: In very simple terms, the economics of these arrangements (and the business case supporting them) are based on the customer’s projected deployment volumes (use rights) and anticipated deployment schedule. However, more times than not, neither projected demand nor the anticipated schedule are certain. If you wind up deploying fewer use rights and/or deploying those rights slower than your projected schedule, the financials on which you based your investment (your business case) might never come to pass. (This topic will be discussed in more detail in the fourth installment).  

So what’s the takeaway from all of this? In a nutshell, customers should approach these arrangements with a laser focus on: (1) the potential rewards of the long-term relationship, (2) the risks associated with that relationship, and (3) the measures to pursue both to achieve these rewards and address these risks. When you are asked to sign off on an enterprise or unlimited arrangement, ask the question: “Does the deal reflect and account for the long-term nature and relationship with this publisher?”

Posted
By

Database marketing outsourcing is a strategic transaction for retailers. This type of outsourcing can facilitate the integration of diverse marketing channels (e.g., web, social media, catalog and in-store sales) and enable more targeted and effective marketing to consumers.

Database marketing encompasses a potentially broad array of services, including:
• Implementation and hosting of a CRM database marketing solution;
• Data cleansing, matching, updating and enrichment;
• Data licensing;
• Data mining and analytics / reporting; and • Campaign management and analysis.

This is the first of two articles highlighting some key business and legal considerations in these transactions. In this article I will discuss scope, sizing and pricing considerations.

Scope Considerations
Database marketing services are designed to give internal marketing organizations better data, tools and capabilities to conduct marketing campaigns, analytics and related activities. Clients may also purchase a broader suite of services, including marketing campaign execution support.

In our experience, large retailers with mature internal marketing departments tend to favor the former approach (often coupled with significant customization of the supplier’s standard offering) while smaller organizations with less mature marketing capabilities gravitate toward a broader suite of the supplier’s standard service offerings that includes professional services support for marketing activities. A high level of customization of standard supplier service offerings is often beyond reach for smaller organizations that cannot afford the time, cost and resource demands of a significant customization exercise. Customers need to evaluate which approach is best aligned with their internal capabilities and business objectives.

Sizing Considerations
A significant challenge for all customers is properly sizing the solution to meet their projected needs. Pricing is largely based on the volume of customer records and related transactions (e.g., data cleansing, matching and appends) managed by the supplier. It can be extremely difficult for clients to accurately project the growth in these records and transactions, particularly if the database marketing services are being used to expand into new marketing channels such as social media.

An experienced supplier should be willing to help clients develop growth projections based on their experience with similarly situated customers. Clients would be well served to invest significant effort in this modeling before locking into a contract with a supplier. Of course, these models will likely be quite speculative, so the client’s project budget should allow for material variations.

Pricing Considerations
Pricing for database marketing services typically consists of some combination of the following elements:

Implementation Charges – Project charges for implementing the CRM database and associated tools to enable the delivery of services. Typically, this is priced on a fixed fee basis for the labor associated with implementing the solution. Clients should generally resist time and materials pricing for the implementation because it will be difficult for the client to assess the amount of effort required. Suppliers should have sufficient experience in implementing comparable solutions to provide a reliable fixed fee proposal.

Dedicated Asset Charges – Charges for hardware and third party software dedicated to the client’s solution. These costs should be treated as pass-through expenses with no markup or, at most, a small administrative fee to cover the procurement costs. There should not be a separate charge for the shared infrastructure used by the supplier in delivering the services (i.e. those costs are captured in other pricing metrics). Because the supplier will be in a better position to size the dedicated hardware / software requirements based on the projected workload volumes, it is reasonable for clients to negotiate provisions that would hold the supplier responsible for the cost of any additional dedicated hardware / software that may be required to properly support those projected volumes.

Recurring Production Services Charges – Base monthly fee for hosting and maintenance of the database marketing solution, including database management and end user support. The base monthly fee may be tied to a baseline volume of customer records with incremental records charged at a click fee per thousand records. Rates may vary between addressable (i.e. customer name with postal address) and non-addressable customer records due to differences in update processing requirements. Clients should consider negotiating lower rates for non-addressable customer records.

Data Product / Transaction Fees – Variable fees tied to the volume of transactions processed and data appended to customer records by the supplier, including data cleansing, trade area appends, reverse email appends, reverse phone appends and the like. It is important for the client to have a clear understanding of how transactions are counted, particularly how they apply to periodic update processing and refreshes of customer records, and when matches with data in the supplier’s own databases are included or excluded from the count. The processing of a single customer record can trigger multiple charges (e.g., cleansing, matching and appends) as it runs through a waterfall process. The contract should include diagrams of the process flows and suppliers should be required to provide projections of their transaction charges based on these process flows. In addition, clients should have the right to require suppliers to adjust the criteria for determining what constitutes a “match” in the waterfall process for any data matches that trigger discrete transaction charges.

Marketing Campaign Support and Other Professional Services – Monthly recurring charges for a baseline number of hours of support. Clients should have the right to scale the baseline number of hours up or down on reasonable advance notice and purchase additional hours above the baseline at discounted rate card rates.

Minimum Spend Commitments / Volume Discounts – Suppliers typically seek minimum spend commitments and tie discounts off their standard rates and charges to these commitments. Any such minimum spend commitments should meet the following requirements: (i) be easily met based on conservative projections of workload volumes; (ii) can be satisfied over the entire contract term rather than an annual “use it or lose it” approach; (iii) allow for carryover of any deficiency into at least one renewal period; and (iv) if not satisfied, result in the client only paying the supplier the unrealized profit on the unsatisfied balance of the commitment rather than the full amount of the unsatisfied balance (since the unrealized profit represents the supplier’s actual damages based on the failure of the client to meet the commitment). Conversely, clients should negotiate volume discounts for spend in excess of the minimum commitments.

In the next article I will discuss performance and data considerations in connection with database marketing outsourcing.

Posted
By

We recently posted a three-part series on BYOD issues in this blog. A primary theme was the inherent tension between employer control and employee privacy in a BYOD environment. In a recently reported case out of the Northern District of Ohio (Lazette v. Kulmatycki), the courts had an opportunity to clarify how to walk this tightrope. Unfortunately, in struggling with existing (and somewhat inadequate) laws, the result seems to have made the rope even more fine rather than clarifying a path across the divide.

Background of a BYOD Case
The case begins with a corporate-liable Blackberry device of a former employee (Lazette) being turned into the employer upon separation. Lazette dutifully deleted her personal email account from the device before returning it to her employer – or so she thought. For whatever reason, her personal email account remained, and her former boss (Kulmatycki) proceeded to read some 48,000 personal emails over the course of the ensuing months.

The headline from the case is that the boss was at fault for reading the emails. This result “feels” right. After all, Lazette no longer worked there, so why was Kulmatycki reading her personal emails – even if he may have had the right to do so when she was still an employee and had personal email on a corporate-liable device.

What is more interesting about the case is the way in which the court twisted and turned existing laws that did not quite fit the situation.

Laws Addressed by the Court
Law #1: The Stored Communications Act (SCA). Loosely speaking, the SCA protects against intentional access to stored electronic communications. As relevant here, the case notes that the SCA only applies to “storage,” meaning held “for the purposes of backup protection.” The court then reasons (with curious logic) that emails that have not yet been read are within this definition of “storage,” but that those that have been read but not deleted from the inbox are not held “for the purposes of backup protection” and are thus not “stored” under the SCA or subject to the SCA. The upshot … those emails Lazette read before Kulmatycki got to them are not protected under the SCA, while those she read after are.

Law #2: Anti Wiretapping Laws. Anti-wiretapping laws generally prevent the unauthorized interception of communications. The court considered whether Kulmatycki “intercepted” Lazette’s communications. Because the communication had already been sent to Lazette’s computer when it was also sent to the Blackberry, the court found that Kulmatycki had not “intercepted” Lazette’s emails and the wiretapping laws were inapplicable. Under this logic, it would be interesting to consider if Lazette could demonstrate that her computer was offline while Kulmatycki received and read certain emails on the Blackberry, those emails would fall within the wiretapping laws.

Law #3: Invasion of Privacy. The court did not ultimately decide whether Lazette’s rights of privacy under Ohio law were violated, but acknowledged that Ohio’s privacy law could apply if the right constellation of factors aligned. This would be a factual determination as to whether Lazette had a reasonable expectation of privacy and would be subject to state law (meaning that the same facts could conceivably lead to different results in different states).

Lessons
At a macro level, this case should be a warning to employers to continue to be careful with personal information in a BYOD environment. The court ultimately held that there was potential liability for Kulmatycki’s actions. The potential liability for employers could be significant.

Perhaps more interestingly, this case demonstrates how difficult it can be to apply existing laws to new technologies and the new issues they spawn. Predicting how a court will rule in a particular instance becomes immensely difficult. So, when your lawyers say “it depends” and “we had better be careful,” don’t be annoyed. Understand that they are trying to help you walk a tightrope in a brave new world where courts are doing their best to apply laws that do not quite fit to the “bleeding edge” legal issues of the day.

Posted
By

This article was originally published in the July 22, 2013 issue of Texas Lawyer.

The constant threat of cyberattacks presents many and varying challenges for businesses. Insurance provides one way to deal with them. Because the market for insurance covering these risks and the law interpreting these policies both continue to develop, this is an area in which attorneys can help clients by maximizing their opportunity to secure the broadest possible coverage.

A look at federal and state action on cybersecurity risks provides some critical background. President Obama issued his Executive Order on Improving Critical Infrastructure Cybersecurity in February. In October 2011, the U.S. Securities and Exchange Commissions Division on Corporate Finance issued relevant guidance on financial-disclosure obligations concerning cybersecurity issues in CF Disclosure Guidance Topic No. 2 – Cybersecurity.

Texas law also imposes some key legal requirements on businesses. Texas Business & Commerce Code Chapter 521 imposes duties on companies to protect sensitive personal information collected or maintained in a company’s regular course of business and to notify affected individuals if the security of a computerized system containing that data is breached.

A look at cyberattackers also provides important perspective. Wrongdoers can target a company’s trade secrets or product-development pipeline for competitive, nationalistic or societal reasons. In addition, certain industries with a strong presence in Texas, such as energy, petrochemicals, transportation and technology, face particularly frequent attacks due to their unique characteristics and vulnerabilities.

When prevention efforts are insufficient, a data security breach often imposes first-party losses in the form of response costs and impacts on the company’s revenue stream. These can include expenses for detecting, investigating and eliminating the intrusion, notifying those affected by it, managing the company’s reputation and dealing with revenue impacts from damaged customer relationships. Third-party claims also can result, in the form of lawsuits and regulatory actions.

Because these issues touch on so many aspects of a company’s business, from negotiating vendor agreements to compliance to litigation, lawyers have many opportunities to help clients address these risks. Insurance coverage provides one such opportunity.

A company’s traditional insurance policies may offer at least some protection. In Retail Ventures Inc. v. National Union Fire Insurance Co. of Pittsburgh, PA (2012), the 6th U.S. Circuit Court of Appeals held that a “computer fraud” endorsement to a crime insurance policy covered more than $5 million in losses arising out of the illicit access to customer accounts stored in a retailer’s database. These losses included expenses for customer communications, public relations, customer claims, and investigations by multiple states and the Federal Trade Commission, as well as chargebacks, card reissuance costs, account monitoring and fines imposed by the credit card issuers.

The insurance industry’s offerings for specific cybersecurity policies also have grown rapidly in response to this threat. Just going through the process of applying for cyberinsurance can improve a company’s risk awareness. Large insurance brokers often use illuminating self-assessment questionnaires that pose dozens of queries on topics such as background checks, employee and contractor training, network security protocols, prior incidents and crisis-management procedures.

Attorneys will need to guide clients through varying policy options. Current cyberinsurance offerings lack the standardization that develops after court challenges refine policy language and the marketplace comes to accept that language.

Given the lack of industry-wide agreement on policy language, an “off the shelf” policy may be ill-suited to a particular business. Because the market is still developing, lawyers can have a greater impact in negotiating more favorable terms for a specific client’s unique needs. The policy should cover both first-party and third-party losses, as a cyberattack often triggers both.

Here is a list of some other issues to consider when purchasing a cyberinsurance policy:

  • A simulated cyberattack can create an opportunity for detailed analysis. Several publicly available sources track costs associated with data security breaches. Because of the wide-ranging impacts a cyberattack can have, the total costs of these incidents are often significantly higher than the largest individual component. On the other hand, some aspects of a cyberattack may be relatively minor for a particular company.

    • Gaining a thorough understanding of the company’s risk profile through a simulated cyberattack will help guide decisions on issues such as the amount of overall limits, particular sublimits and deductibles.

  • Does the policy cover acts of third parties with access? If the company provides confidential data to third parties or allows vendors access to its secure systems, the policy should offer coverage for that exposure. Recent headlines involving rogue employees at third-party contractors demonstrate the importance of closing off this potential gap.
  • Seek coverage for unknown breaches that may have occurred already. A recent fraud summit revealed that early detection of cyberattacks remains a significant challenge. Accordingly, policyholders should seek retroactive coverage to protect against intrusions that began prior to the policy but only caused losses during the policy period.
  • Broad exclusions can have unintended consequences. Suppose a cyberattack leads to an environmental liability. Is there a pollution exclusion geared towards more traditional risks that would preclude coverage for the cyberattack? Counsel should address these issues and narrow relevant exclusions, if possible.
  • The right to choose counsel is critical. Choice-of-counsel provisions may matter here more than other areas. A company’s comprehensive cybersecurity plan may already have designated counsel as part of a crisis-response team.

This is something a business typically can negotiate with the insurer before a loss occurs. Left unaddressed, a company may find itself arguing about selection of counsel at a time when it most needs the help of trusted lawyers who know the company well.

For companies involved in significant technology outsourcing arrangements, it is important to examine vendor agreements for cybersecurity issues, as well as for insurance and indemnity provisions that a cyberattack involving the vendor may trigger. That analysis may suggest needed modifications to these agreements for more robust protections.

Managing cyberattacks may be a more achievable goal than preventing them. Fortunately, paying close attention to insurance issues is one way lawyers can help companies with that effort.

Posted
By

On July 24th, 2013 the Massachusetts legislature passed An Act Relative to Transportation Finance (“the Act”), which, among other things, makes “computer system design services and the modification, integration, enhancement, installation or configuration of standardized software” taxable services under the Massachusetts sales and use taxes. Under the Act, “Computer system design services” is defined as “the planning, consulting or designing of computer systems that integrate computer hardware, software or communication technologies and are provided by a vendor or a third party.” The Act passed despite Massachusetts Governor Deval Patrick’s veto, and the new tax becomes effective July 31st, 2013.

The Act makes Massachusetts one of four states that tax computer services. Maryland expanded its definition of taxable services to include computer services in November 2007, but the computer industry fought hard to reverse the decision. On April 8, 2008 the Maryland legislature repealed the tax before the changes took effect. Websites are already appearing to repeal the Massachusetts tax, but considering (a) the effective date and (b) that the legislature overturned the Governor’s veto of the Act, a similar repeal in Massachusetts seems unlikely (at least in the near-term).

Customers and service providers alike should consult their tax attorneys to determine whether and to what extent the expanded definition of taxable services in Massachusetts impacts them. For basic information and guidance regarding the tax changes, you can refer to the Massachusetts Department of Revenue (DOR) technical information release 13-10 (“TIR 13-10”). The DOR has not yet updated Regulation 830 CMR 64H.1.3 (Computer Industry Services and Products) to reflect the new scope of taxable computer industry services but TIR 13-10 states that it intends to do so. The current Massachusetts sales and use tax rate is 6.25%.

Although computer services taxes are uncommon, changes in taxes are often contemplated by service agreements. If the Massachusetts tax changes impact you, you should (a) review how such taxes are treated under your services agreements, (b) engage your service providers to determine how and when they will invoice such taxes, and (c) communicate the changes to your internal stakeholders. If you are currently in the process of procuring services impacted by the Act, such as systems integration services, you should consider adjusting your financial business case to ensure you have an accurate total cost for procuring such services.

The DOR is requiring July and August taxes to be reported and paid in September (“for the convenience of both taxpayers and to facilitate administration, DOR directs that Computer/Software Services transactions for July 31, 2013 shall be reported and paid together with August 2013 transactions by the September 20, 2013 due date for August 2013 transactions.”).

Posted
By

Today the European Commission unveiled its legislative package to adapt the EU payments market to the opportunities of the single market and to support EU economic growth . The package includes a proposal for a cap on multilateral interchange fees (MIFs) for card-based payment transactions. MIFs are set by credit-card companies and collected by banks each time a consumer makes a purchase on a card. Fees across Europe vary widely, from less than 0.2% in the Netherlands to more than 1.5% in Poland. In addition, surcharges on consumer debit and credit cards will be banned by the new Payment Services Directive (PSD2). Surcharges are the extra charge imposed by some merchants for payments by card and, according to the Commission, are common notably for purchases of airline tickets online. In 95% of cases, merchants will no longer be allowed to surcharge consumers for using payment cards, whether for domestic or cross-border payments. This measure alone is set to save consumers 730m euro each year. So called ‘three-party schemes’ such as American Express and Diners, as well as commercial cards issued to businesses, which together account for the remaining 5%, are not covered by the surcharging prohibition. Retailers will be able to surcharge for these cards or refuse to accept them.

Introducing the legislative package, Michel Barnier, Internal Market and Services Commissioner, said “…the proposed changes to interchange fees will remove an important barrier between national payment markets and finally put an end to the unjustified high level of these fees.” Vice President Joaquín Almunia added “…interchange fees paid by retailers end up on consumers’ bills. Not only are consumers generally unaware of this, they are even encouraged through reward systems to use the cards that provide their banks with the highest revenues… the regulation capping interchange fees will prevent excessive levels of these fees across the board.”

MIFs have long been under regulatory scrutiny, with laws adopted in the United States, Australia and other countries, and several EC decisions under EU competition laws including the 2007 MasterCard case. Although included in a merchant’s cost of receiving card payments, regulators are concerned that interchange fees are ultimately passed through to consumers through higher prices amounting to tens of billions of euros each year. With Visa and MasterCard’s market share estimated at 96.8% in value, and with interchange fees already banned in countries such as Denmark and the United States, the Commission believes that regulation is required. This is despite the MasterCard case, the proceedings against Visa Europe (which lead to undertakings for consumer debit cards in 2010 and consumer credit cards in 2013) and a rash of other national competition proceedings.

Although the Commission does appear to recognise that interchange fees might be beneficial in encouraging banks to incentivise increased card issue and use (e.g. through air mile and other rewards schemes), the Commission sees even greater drawbacks. A key concern is that market participants may promote high-fee cards, with card companies competing to attract issuing banks through the highest interchange fees, leading to increased merchant costs which are then passed on to consumers in the form of higher retail fees. As the Commission FAQ puts it, “consumers paying with debit cards or in cash…’subsidise’ the air miles of the users of expensive cards.” Furthermore, new entrants (e.g. providers of mobile or online payment services) and low cost domestic operators are arguably shut out of the market because the banks demand the same high revenues that they achieve on normal card payments, meaning that European companies are disadvantaged compared to their global competitors.

The proposed Regulation will cap interchange fees at 0.2% for debit and 0.3% for credit card transactions. The 0.3% cap is below the interchange fee levels prevailing in all Member States. The impact on credit card acceptance is therefore likely to be significant. In some countries such as Poland and Hungry where the current level of interchange fees is well above the caps, the impact will likely be substantial with a big uptick in merchant acceptance as compared to current levels. Card payment is only possible in an estimated 30% of retail outlets in Poland and Hungry at present.

At a press conference to preview the package held in Brussels last week, Commissioner Barnier went on the offensive, describing MIFs as a “cash cow” for card companies. In response, MasterCard and Visa Europe question the Commission’s stance and deny that MIFs operate in an anti-competitive manner. Peter Ayliffe, president and chief executive of Visa Europe, said that there was “little evidence” that the plan would benefit consumers. Javier Perez, president of MasterCard Europe, said that the proposal might “actually harm competition and inconvenience consumers” as well as preventing competition and hindering payments innovation in Europe.

The Regulation may signal the end of the Commission’s decades-long anti-trust battle against MasterCard and Visa Europe. But the plan has a good way to go before it becomes law: it will be discussed and likely modified by EU member states and the European Parliament in a process which could take several years. The debate is far from over.

Posted
By

Jim Gatto and James Chang recently published “Mobile Privacy Practices: Recent California developments indicate what’s to come” in the June issue of Computer Law Review International.

The use of mobile applications has seen huge growth in the past few years. As the use of apps become increasingly commonplace, social concerns such as the privacy of app users will increasingly need addressing. California is taking the lead in regulating this important issue. For more information, including an overview of mobile privacy, a summary of California’s stance on how to address the issue, an overview of the state’s principles regarding privacy, its best tips for complying with its principles, and an examination of the privacy related laws outside of California, please read the full article: Mobile Privacy Practices: Recent California developments indicate what’s to come.

Posted
By

The Affordable Care Act of 2010 mandated the creation of health care exchanges (“Exchanges”) which will enable individuals to shop on-line for health insurance beginning October 1, 2013. Creating and configuring the software, databases and interfaces that comprise the technology platforms for these Exchanges has created huge challenges for the fifteen States and the District of Columbia that have decided to build their own Exchange rather than rely on the Exchange being developed by the federal government, as well as for the health insurance companies planning to market and sell their insurance through these consumer portals.

The Exchange mandate has generated a massive amount of IT work and required more technological change than possibly any other federal law to date. To provide an idea of the complexity of building these platforms:

  • Software must be developed that permits multiple health insurers to offer multiple insurance products through a single government-run portal with a common look and feel.
  • The Exchange systems must interface with federal government databases for purposes of determining whether buyers are U.S. citizens or legal residents, and whether they are eligible for government subsidies.
  • Health insurers must integrate their enrollment and membership systems with the Exchanges in order to enroll new members and include them in their membership records, as well as put in place functionality for individuals to pay for their new insurance on the Exchange via credit card and ACH transactions.

Adding to the challenge of developing and implementing these new systems is the political uncertainty created by continuing efforts by opponents of health law reform to overturn the legislation.

To meet their Exchange objectives, health insurance companies have been confronted with the choice of whether to “build or buy” the necessary software functionality and technology necessary to get them up and running on the Exchanges. Given the looming October 1st deadline, many have elected to license the software from third parties and have the third parties integrate the software with existing systems. Relying on a third party to get this done presents its own set of risks. These risks can be mitigated however, by using certain “best practices” utilized when contracting with a third party to install and integrate a new software platform with existing systems. Those best practices include:

  • Implementation Project Plan – In connection with any system implementation project, the supplier will generally prepare an implementation project plan describing the steps to be taken to implement and integrate the software and the timing of those steps. This is important because there are generally multiple parties involved in a system implementation. In addition to the customer and the party licensing and implementing the software (which may be two separate parties), there may be one or more outsourcing suppliers who may be responsible for maintaining and operating existing systems which must be integrated with the new software, or a company providing staff augmentation services. The project plan helps to align all interested parties so that each party may have the proper resources available at the proper time, and deliverables completed as needed, in order for the project to stay on track. The project plan should therefore be included as contractual obligations of the impacted parties, and any changes should require the consent of the customer.
  • Critical Milestones – The customer and the supplier should identify key points in the implementation process (sometimes known as “Critical Milestones”) which reflect the achievement of important steps in the overall process, such as (1) functional and technical design documents completed; (2) configure, build, deploy and test the integration with the customer; (3) build, deploy and test the integration with the Exchange; (4) end to end testing complete, and (5) user acceptance testing complete. These Critical Milestones, along with the dates by which each of these must be achieved, should be included in the contract. The Critical Milestones can then be used as clear, bright line tests which, if they are not met on time, will entitle the health insurance company to terminate the contract if it chooses.
  • Financial ramifications for failing to achieve Critical Milestone on time. There is no better mechanism for incenting prompt performance by the supplier than to establish financial ramifications to the supplier that are triggered when the supplier either meets the Critical Milestone on time or fails to do so. One such approach is to allocate the implementation charge among the Critical Milestones, and state in the contract that the portion of the implementation charge associated with the Critical Milestone will only be paid when the supplier achieves that milestone. Another approach is for the parties to agree on an amount that the supplier will pay or credit to the customer if supplier fails to meet one of the Critical Milestones on the applicable date.
  • Acceptance Criteria – In order to avoid disputes, it is important for the parties to agree upon and document objective “acceptance criteria” which must be met before a Critical Milestone will be deemed to be achieved. This will ensure that the parties are aligned on what constitutes achievement of a particular milestone. The Acceptance Criteria should be agreed upon up front and included in the contract. If it is not possible to establish these criteria up front, it should done as soon as possible after contract execution. The parties should not wait until the Critical Milestone is ready for acceptance testing, since at that point it may be too late to address differences of opinion about what needs to be completed in order for a particular milestone to be achieved.
  • Key Supplier Positions. If there are particular supplier employees whose knowledge and/or skills are important to the success of an implementation, they should be designated as occupying key supplier positions. Such a designation generally means that the supplier will not remove that individual from the customer’s account for some designated period of time. This helps ensure that the key people will remain committed to the customer’s project and will not be transferred off of the customer’s project should a bigger client come along.
  • Software Escrow Agreement. For transactions in which the supplier is hosting or operating the software after it is implemented, health insurance companies and other customers should consider asking the supplier to establish an escrow for the software so that it may be accessed in the event that there is a serious with the supplier, such as a material breach of the agreement by supplier, or a supplier goes into bankruptcy. The escrow should include both the object and source code if the customer does not otherwise have access to the software, or just the source code if customer already has access to the object code. The negotiation here is generally around what the “trigger events” are that will trigger a release of the software from escrow.

Utilizing the foregoing contracting best practices will protect health insurance companies involved in system implementations to better meet their objectives regarding the new Exchanges, and will also benefit any other companies involved in system implementation transactions.

Posted
By

Deploying a software package across the company (or most of the company) is becoming a reality for most companies. Standard processes and systems drive cost, quality and performance improvements. Unlimited deployment rights may also reduce transaction costs and project completion timeframes. The right enterprise and unlimited license agreement can make all the sense in the world.

In the first installment of this blog, we set up a scenario where you are a CIO faced with a decision on whether or not to enter into an “enterprise” or an “unlimited” license arrangement with a major software publisher. In discussing the first of our four questions (“What does “enterprise” or “unlimited” really mean?”), we explained that there are many potentially perilous pitfalls in these license arrangements, and conveyed how you might to look to avoid or mitigate them.

Again working from our four-question framework, let’s now focus on the second question: “Do we really want to be doing business with this publisher?”

The customer-publisher relationship born under an enterprise or unlimited agreement often lasts a very long time. With apologies for using perhaps a tired analogy, these relationships may last longer than many marriages (and probably are even more difficult (certainly more expensive) to dissolve). Like marriages, people enter into these arrangements for a variety of good reasons.

IT professionals understandably embrace the benefits, perceived flexibility and freedom these arrangements appear to create. (Remember back to the first installment of this blog where we pointed out how these arrangements may not be as flexible as they appear on the surface). With the appearance of little or no marginal license fees for the next deployment (and since these arrangements often are the byproduct of a broader, perhaps mission critical, strategy that must be implemented quickly), the IT professional may encounter less scrutiny on his or her deployment choices or may be encouraged to deploy products covered by an existing arrangement.

For the CIO, where the business case is met, enterprise and unlimited deployment agreements also tend to be attractive because these agreements are seen as a vehicle to secure a closer relationship with a mission critical supplier.

While the arrangement may well advance the strategic goal of teaming up with a mission critical supplier, in most cases it also means the CIO is embarking on a very long relationship with that supplier. As the system or platform is implemented and then put into operation, the customer may enjoy a good deal of flexibility and scalability within the confines of that system or platform. However, once the system or platform becomes embedded in day-to-day operation of the business and the term of original arrangement is over, the customer’s options (i.e., ability to change publishers) may be significantly diminished. There are two primary reasons for this.

  1. Switching Costs
  2. Overcoming Organizational Resistance

Let’s explore these constraints briefly.

With regard to switching costs, there are many cost categories that come in to play. One area that tends to be overlooked (or underestimated) is the magnitude and impact of the soft costs associated with moving to new platform or system. For example, operational change management can be disruptive and impact the bottom line if not planned and executed properly. There are also some cost categories, like the cost of capital, which vary considerably from one customer to the next. The simple example below demonstrates that the switching costs can be considerable and can pose significant barriers to change.

The example looks at the cost of new license fees compared with incumbent support fees and how it makes exiting (or significantly changing) the relationship with the incumbent difficult to justify. This applies to technology products as well as applications.

Simplified Fact Pattern:

  • An existing application runs on a four-processor machine and uses an XYZ database.
  • To go along with the application, five years ago you purchased the XYZ database license at a discount for $32,000.
  • Annual support on the XYZ database has been frozen at 20% of net license fees ($6,400/year) until next year when it will begin to increase by at least 3% annually.
  • ABC publishes a competing database that offers all of the functionality required by the application.
  • A similar sized license for the ABS database can be obtained for a net license fee of $30,000.
  • ABC agrees to an 18% annual support multiplier ($5,400/year), a freeze on support for four renewals and a 3% year over year cap thereafter.
  • Ignore the cost of re-platforming for the moment
  • Assume a 6% cost of capital.

Conclusion:

  • Despite the significant reduction (in percentage terms) in annual support with ABC, over a ten-year planning horizon, you are better off by more than 31% on the NPV by continuing to do business with XYZ.
  • The cost benefit of staying with incumbent XYZ would hold until ABC’s net license fee drops below $22,700.
  • And by plugging back into the equation the re-platforming and transition costs (hard and soft), the business case to stay with XYZ becomes even more compelling.

The second constraint – “Overcoming Organizational Resistance” – recognizes that the effort required for change (real or perceived) is complex and usually viewed as daunting. Even if the financials are compelling, customers are often faced with the question of whether there is sufficient oversight and management bandwidth to implement and socialize the change. In short, the thought of the change-out may be so distasteful that, like the divorce of long-lived marriage, an IT organization may decide to simply live with a difficult relationship (and perhaps pursue more modest remedial efforts) rather than exit the relationship and pursue a new one.

These two factors afford the incumbent publisher with a distinct advantage over its competition for future business, which from the customer perspective introduces significant constraints on alternative (practical) options. With the upper hand on its competition, the balance of power, if you will, swings decidedly in favor of the publisher and hence diminishes the customer’s leverage to control cost, address performance issues and pursue alternatives.

In summary, even if there are substantial increases in the incumbent’s annual support fees, material reductions in scope of standard support services or less than stellar performance or support, the combination of significant hard costs and organizational resistance to change may extend a long-term relationship to a very long-term relationship.

Although there is no simple solution to these challenges, consider the following as guiding principles to contain the risks:

  • In addition to fundamental diligence considerations (e.g., a good product fit and a defensible business case), the CIO should further test the viability of the relationship by forming a concrete view of the publisher’s reputation, and factor that into the determination of whether the publisher is the right long-term partner.
  • Ask yourself, “Do I really want to be doing business with this publisher (potentially for a very long time)?”
  • If the answer is “no,” find another publisher.
  • If the answer is “no, but I have don’t have an another option” or even if your answer is an unequivocal “yes”, make sure you exploit upfront leverage before you sign by obtaining flexible exit rights and meaningful transition rights for the inevitable day when the relationship comes to an end.
  • Oh, and you will be well served by retaining a seasoned advisor who has been through this process before (many times, preferably).

Posted
By

The rise of cloud computing services and the privacy/security issues involved have been much discussed (see, for example, our prior blog posts here). But when customers procure cloud-based services, a critical “behind the scenes” issue is often overlooked: is the cloud provider itself relying on third party subcontractors to perform critical functions? When these subcontractors are added to the mix, things become a bit more complicated.

Cloud computing offers a wide variety of services:

  • IaaS: infrastructure as a service to replace a customer’s data center or testing environment;
  • PaaS: platform as a service to replace a customer’s applications development environment; and
  • SaaS: software as a service to replace a customer’s need to install and operate software.

Each of these services share the key characteristics of cloud computing (resourcing pooling, rapid deployment, location independence, high scalability) that are appealing to customers. It’s little wonder that Gartner forecasts that the public cloud computing market will grow 18.5% this year to $131 billion worldwide.

When customers think about obtaining cloud services, they should keep in mind that a number of these services can be layered on top of each other with different providers to create a cloud “supply chain”. This makes the customer-facing service more efficient and less costly.

Take, for example, an end user customer that has procured a SaaS solution. This end user customer uses the application but doesn’t control the operating system, hardware or network infrastructure on which it’s running. This is the trade-off that all end user customers make when implementing a cloud solution.

But it may be the case that the SaaS provider itself doesn’t control all of these delivery elements. The SaaS provider, in turn, could be the customer of an IaaS solution. Under this model, the SaaS provider is hosting its application on a third party’s IaaS cloud. The SaaS provider may control some of the delivery elements (e.g., the operating system and storage applications) but it would have no control over the cloud-based infrastructure that supports the application. As with the end user customer, the SaaS provider trades off operational control for scalability and efficiency. The SaaS provider’s use of an IaaS solution makes the SaaS provider’s solution ultimately more “cloudy” and therefore more appealing to the end user customer.

This is just one example of how a subcontractor could be involved. Cloud providers can subcontract a wide variety of functions to third parties (e.g., hosting, storage, processing, transmission, network security, etc.). A cloud provider’s form agreement typically will permit it to subcontract without restriction (and, in fact, its out of the box solution may already rely on subcontractors). So when end user customers consider cloud solutions and perform their due diligence, they should think about not just the main provider, but also any subcontractors that the main provider relies on (now or in the future). This is because a failure or issue at any point in the cloud “supply chain” could affect the service being provided to the end user customer and could affect its ability to access its data.

So what are some of the key questions to ask when considering a cloud provider (and its current or potential subcontractors)?

  • Where is the data stored and who is storing it? It often will be stored by a subcontractor that is in a location with the lowest taxes and cheapest costs. Location may matter more for certain regulated industries and if the data is from certain jurisdictions like Europe. If the solution involves encryption (of either the data itself or the transmission of the data), location also may implicate U.S. export control issues. In certain jurisdictions, the government may have an easier time accessing data if it is stored by a third party in the cloud.
  • Who has the encryption keys to secure the data? If the prime cloud provider or a subcontractor has the keys, the end user customer will not have ultimate control over who can access the data. If any of these providers goes out of business, the end user customer may be unable to get to its data.
  • How are outages treated throughout the supply chain? Are there redundancies built into the system? Do availability, service response and restoration metrics apply to both the prime cloud provider and to all subcontractors? What are each party’s obligations with regard to disaster recovery? Transparency is important here. The end user customer should have as much as possible an understanding of how its solution is architected throughout the chain.

There are, of course, other “due diligence” type questions to ask. But in doing so, it’s always good to consider whether there are cloud subcontractors that are playing key supporting roles behind the scenes.