2. Define how "external" the service provider can be.

"E-mail is mission critical enough that I don't entirely trust outsourcing to someone else. I don't want to hire someone and only find out when we have an issue it's not as secure as we thought it was," Beggs says. "I still wanted to host it onsite, so we were down to having an appliance or having someone host it for us at one of our sites."

3. Define roles between you and your service provider.

Many companies run into problems because they think a SaaS or cloud contract means the service provider is responsible for doing everything from installation to security, according to Sean Hackett, research director for The 451 Group.

The truth is that customers have to be responsible for securing their own data and often other parts of the process itself, he says. Successful SaaS or cloud outsourcing arrangements require defining who is responsible for what.