Even without budget restrictions, outsourcing at that level makes more sense than DIY, she says. "Redundancy is one thing; operational redundancy is another."

5. Roll it out in the easy places first.

Distracting staff at a hotel from guest services to work on IT is a no-no, so Sonesta is rolling the Mimecast service out slowly at its U.S. locations, before moving to overseas properties.

Ownership issues, bandwidth limitations and local regulations are always issues, but so are licensing limitations from software vendors who don't allow their software to run in virtualized environments or in the cloud, which also makes extending the rollout more complex.

6. Know where you are on your own timeline.