(This article appeared in the special edition of the Atlanta Business Chronicle that was distributed at the 2010 Annual Atlanta Small Business Growth Expo)

Whether you believe we’re headed into the second dip of a so-called “double-dip recession” or you think that the worst is behind us, one thing is clear: We have all learned how to do more with less.  And if we are headed into a second “dip”, I predict that there will be far less casualties than the first one, having learned our lessons the first time around… I hope.

More Cloud Adoption

Among those lessons learned was to preserve cash at all costs. This has certainly increased the adoption of Cloud-based solutions for everything from email (Hosted Exchange & Google Apps), to online file sharing and storage, as well as a large range of line of business applications (accounting software, customer relationship management software, etc.).

Adoption of the Cloud as a business’s core IT infrastructure will continue to gain momentum in 2011 for many reasons. As I have already stated, the Cloud lets you hang on to your cash by converting large upfront capital expense’s to much more affordable operating expenses, generally on a monthly basis. This is important for new businesses because it dramatically lowers startup costs and alleviates concerns about scalability. Existing businesses can benefit in a similar way. They can now upgrade their aging infrastructure at a much more manageable cost.

The Cloud is also a much more efficient way to enjoy consistent system and feature updates on a regular basis. Our helpdesk system is cloud-based and we enjoy feature updates once a quarter, versus the once per year that you often get with on-premise software solutions where you’re waiting for the next version to come out.

More Regulatory Compliance

Also in 2011, look for more fines from the Federal Government over violations of regulatory compliance. Despite its passage being 14 years ago, the Feds have started issuing the first fines for violation of HIPAA this year. The recent passage of the American Recovery and Reimbursement Act of 2009 (commonly referred to as “The Stimulus”) included another act called HITECH (Health Information Technology for Economic & Clinical Health Act) which reinforces HIPAA by specifically addressing the privacy and security concerns associated with the electronic transmission of health information.

The medical businesses aren’t the only ones that have to worry. All manner of financial intuitions have a wide range of regulations on them now: Sarbanes-Oxley (commonly called SOX), Graham-Leach-Bliley Act (GLB), PCI DDS (for credit cards), etc.

There are several technologies that companies worried about regulatory compliance will need to invest in:

• Email Encryption: Secures email communication so that only the intended recipient can view the message
• Email Archival: A record of all incoming and outgoing email communication. Most regulations require 7 or more years of retention
• Disk Encryption: secures the content of hard drives on computers. This is especially important for laptop users. There have been many stories in the media lately stolen laptops that contain sensitive data. The Veteran’s Administration is a recent one that comes to mind.
• 2-Factor Authentication: A 2-phase process of authenticating to a network or computer system. Examples are: a password and a thumbprint scan or a password and a token ID gotten from a special application on your mobile phone.

How to Grow Business in 2011

So after you’ve saved money by adopting the Cloud and made the appropriate investments to get the regulators off your back, how do you continue to grow your business in 2011? Ask this question to 10 people and you’ll get 10 different answers.  Some will say “more traditional marketing”, others will say “ implementing social media”,  and another might say “networking”. They’re all correct. You can’t just rely on one medium to market your business. My advice would be to get the online marketing (web site, Google ads, social media, etc.) as automated as possible (hire a firm to handle this for you if you can) and focus on your networking. Expand your personal network with the right people and develop strategic partnerships that are highly synergistic. Make sure that you are also connecting people together. It will pay off, I promise.

Here is a high level view of some of the government regulations that might affect your small business and some suggestions on how to achieve information technology compliance (I specify information technology compliance because you may have to do other things from a human resources or business process perspective that this article does not address.)

Disclaimer: I’m not lawyer and am providing you this information to the best of my knowledge. If you have concerns, seek out an attorney, compliance consultant relative to the the regulation(s) you are concerned with, an IT consultant or any combination of the above.

You can find more information about these regulations and others at http://www.compliancehome.com/

Payment Card Industry Data Security Standard (PCI DSS or commonly called just “PCI”)

PCI is a set of comprehensive requirements for enhancing payment account data security and was developed by the founding payment brands of the PCI Security Standards Council, including American Express, Discover Financial Services, JCB, MasterCard Worldwide and Visa International. Credit card companies and acquirer banks can levy stiff fines and remove the merchant’s ability to process credit card transactions until the merchant is PCI compliant.

Health Insurance Portability & Accountability Act of 1996 (HIPAA)

HIPPA requires that to ensure privacy and confidentiality, all patient healthcare information be protected when electronically stored, maintained, or transmitted. It also mandates that each user be uniquely identified before being granted access to confidential information. It specifies that access to personal health information (PHI) be restricted to only those individuals who need access as part of their role.

Gramm-Leach-Bliley Act (GLBA)

GLBA mandates privacy and the protection of customer records maintained by financial institutions. These security requirements include access controls on customer information systems, encryption of electronic customer information, procedures to ensure that system modifications do not affect security, and monitoring systems to detect actual attacks or intrusions.

Sarbanes-Oxley Act of 2002

This Act came about as a result of the large corporate financial scandals involving Enron, WorldCom, Global Crossing and Arthur Anderson. Effective as of 2006, this Act only affects publicly traded companies. However, being “SOX-like” is a good idea if your goal is to be acquired by a large publicly traded company.

Technology Required for Compliance:

In the case of PCI, HIPAA and GLBA “encryption” and “archival” are the two words you will run into the most and likely to cost you the most money because it will require additional purchases in technology solutions.

Encryption

Encryption simply means “To conceal information by means of a code or cipher” so that only authorized people can access and use the information. In the case of PCI, HIPAA and GLBA, and, as it relates to information technology, files (information) and email (communication) must be encrypted.

To encrypt disks and files you can use Windows Server 2008 using the built in Encrypting File System feature or, for R2 users of Windows 2008 server, Bitlocker is available. which is what you would use on Windows 7 Enterprise or Ultimate desktops and laptops as well.

Email encryption would need to be done through a third party provider such as Carceron.

Email Archival

HIPAA and GLBA also require email archival. Even though recent versions of Microsoft Exchange come with some limited archiving ability, it’s not sufficient from a compliance perspective. You will need a third party company that can capture all ingoing and outgoing correspondence in an off-site archive where messages cannot be deleted. This is especially important for any financial businesses regulated by SEC through GLBA.

Access Control & Auditing

All of the above regulations have requirements regarding access control to files, email etc. as well as auditing requirements. Auditing in this case translates to “logs of who access what and when”. All of the current Windows systems (both server and desktop based) have these features built in – they simply need to be configured by an IT consultant. Another means of preventing access to sensitive information is 2-factor authentication.

.

The concept of Time Compression was recently introduced to me by a client at the conclusion of a recent meeting. I was so enthralled by what he taught me that I did some more research that night and found several articles that further elaborated on the concept and what it means for business.

The first article I found, Technology’s Time Compression, is an excellent primer. At the bottom of that article are links to several other articles, all worth reading, but the two that were most interesting to me were It’s Time for Zero Time and We are Literally Trying to Stop Time.

What I got out of the latter two articles is that, at a minimum, we are trying to reach zero time, preferably negative time. The analogy of a track runner is quite appropriate. Track runners are constantly trying to reduce their times, with the ideal time being zero seconds. But can we achieve negative time? I don’t think a runner could, but we might able to as business owners. This is why business intelligence (BI) and dashboards are so hot right now. Dashboards are more than being able to see real time performance – they are about predicting the future and being ready to adapt to it instantly. You might argue that adapting instantly would be a definition of zero time. However, without proper business intelligence, you won’t be able to make the necessary predictions and subsequent preparations for that instantaneous switch. Negative Time is about being able predict when the change will come and changing at that precise moment (because you’re ready for it), versus reacting to the change once it has come to pass – where the first phase of the reaction is planning (what are we going to do?) and execution (doing it) both of which take time and make you late to the race.

Think about how this translates to business in terms of things like response time, resolution time, order time, processing time, or any other operational task where time is “consumed”.

In my business, Carceron, we monitor servers, networks and desktops in attempt to predict failure. These articles tell me that we can probably be doing a lot more with our monitoring and other business processes.

How can you achieve Negative Time in some of your business processes?

When I sat down with our customer advisory council about this, we were told our biggest distinction was our customer service. However, I am finding that difficult to market because I want the message to rise above the status of a platitude. When is the last time you went to a networking function only to hear people say the same old crap:

“We pride ourselves on customer service”

“We the most reliable, dependable, etc.”

blah, blah blah. It’s all talk unless you can prove it.

What I want to market, the story that I want to tell the world, is that we are the best at what we do. Something like:

“Everyone claims to have great customer service, but we can prove it!”

Some of the ideas I have had are:

• Promoting that we are the most recommended IT consulting firm on Linkedin.com (already using this)
• Customer Service Award from the Better Business Bureau or some other type of entity (we have a competitor that has done this

I’m not thrilled with the idea of awards because I think people today realize that many such awards are shallow victories. The chance of you winning an award these days seems to be more about who you know than actually possessing the merit to deserve the honor.

I need a way to prove that Carceron is the best at Customer service and I need a way to spread the word. Can you even market customer service?

P.S. If you have any other ideas around differentiation for a managed IT services business such as mine, I am all ears.

P.S.S. I’m not looking for a marketing consultant, so please don’t reply with a solicitation.

If you are a professional services firm, your product is time. It is “inventory” that once it passes is gone forever (much like an unused hotel room). As such, for employees whom are billable, they need to devote as much of the workday as possible to billable activities. None of this should be very surprising, but if you observe many professional services firms you’ll see these billable employees doing everything from accounting to human resources to IT. If you work in a professional services firm, I encourage you to keep a very detailed log of every minute of your work day to see for yourself. Odds are you are getting caught up in all kinds of stuff that is better handled by someone else… who isn’t billable.

For accounting: get a book keeper or outsourced CFO. For human resources: try a full service PEO firm such as HR Outsourcing. For information technology management: enter into an agreement with a managed IT services provider. Here is why:

1. MSPs Are More Cost Effective: You can outsource the entire support of your network for a flat fee, including: monitoring, unlimited helpdesk hours, anti-virus software, anti-spam service, email archival and more, for only a few dollars per user per day (or less than 10% of one billable hour per day – assumes a network of 100 or less workstations)
2. MSPs Make You More Productive: A managed IT services firm will generally charge a flat fee for services rendered. This means that your firm will be more productive because it is in the managed IT service provider’s best interest to keep the network fully operational (each trouble ticket or monitoring failure eats into their profit margin).
3. MSPs Provide More Value: MSPs frequently bundle many other services into their managed services offering such as monitoring, anti-virus software, anti-spam service, email archival, and off site backup.
4. MSPs Are Better Than an In-House IT Manager: Managed IT service providers cost about ½ – 1/3 the cost of a full time employee. Unlike employees, managed IT service providers don’t get sick, don’t take vacations, come with their own insurance if they screw up, come with their own suite of software and services (e.g. anti-virus, monitoring, etc.) and don’t need to be equipped with laptops, mobile phones, etc. Besides, why would you put something as crucial as your business network in the hands of one man? A managed services provider will also have more skills sets and experience at their disposal.
5. MSPs Are Better Than a One Man Band: As with the In-House IT Manager, “Why would you put something as crucial as your business network in the hands of one man”? There are many talented one-man IT companies. But… What if something happens to him? What if he gets mad at you?  He can’t very well monitor your network if he is helping another client. What if you have a network emergency and he is with another client and can’t come to you right away? A managed services provider will also have more skills sets and experience at their disposal.

In summary, outsourcing management of you IT and other areas of your business can create massive leverage and allow your firm to bill more time. Now who does not want that?

So, here goes:

When you buy that sub-$300 computer from your favorite store it generally comes with a Home Edition of whatever the current operating system is. The problem with this is that Home Edition Windows operating systems cannot connect to Windows domain servers (this is by design). You must have a business edition operating system to accomplish this, in the case of Vista those editions are Business, Enterprise or Ultimate (Enterprise is for larger companies under a Open Value license plan). So if you buy a PC with Home edition, you have to spend $100-$200 on purchasing the upgrade edition to take it from Home to a Business class edition operating system. You can probably do this yourself, but you might have an IT technician do it, which means an additional $100-$300 in labor.

Next: Almost everyone use Microsoft Office. These sub-$300 never come with Office (perhaps a 60 day trial, but that’s it). Office Basic (Word, Excel, & Outlook) will tack on an additional $100+ and the Small Business Edition (what most people use because it also has PowerPoint & Publisher) will tack on another $300. (Sadly, many businesses skirt this by installing the same Office licenses on every PC, which is obviously illegal).

Finally: A new monitor. this component is obviously optional if you are replacing an existing PC and simply want to use the existing monitor, but if you want a new system, the starting price is $150+.

Let’s summarize least and worst case scenarios:

Least Case: For example, replacing an old computer at your business

• Upgrade to Vista Home Premium to Vista Business +$100 (do installation yourself)
• Buy Office Basic $100
• No monitor, (you have a spare)
• Total: +$200

Worst Case: For example, adding a brand new computer that needs a full Office suite

• Upgrade to Vista Business +100
• Buy and install Office Small Business Ed. +$300
• Monitor +$150 (17′ LCD)
• Labor to install Vista Upgrade and Office software: +300
• TOTAL: +$550 w/o labor; +$850 w/labor

So a new PC, if purchased correctly, really costs more like $500 – $1000.

Don’t believe me? See for yourself. This is a Dell Inspiron that I created this morning. The Inspiron is their consumer class, absolute cheapest model (both in cost and quality).