Decision Framework
Build vs Buy là một trong những quyết định có impact lớn nhất đến project success. Quyết định sai dẫn đến hoặc reinventing the wheel (build) hoặc vendor lock-in và thiếu flexibility (buy). Framework dưới đây giúp đánh giá objective.
Scoring Matrix
Đánh giá mỗi criteria trên thang 1-5, nhân với weight:
| Criteria | Weight | Build Score | Buy Score | Build Weighted | Buy Weighted |
|---|---|---|---|---|---|
| Time to market | 20% | ? | ? | ||
| Total cost (3 năm) | 25% | ? | ? | ||
| Customization needs | 15% | ? | ? | ||
| Team expertise | 10% | ? | ? | ||
| Vendor risk/lock-in | 10% | ? | ? | ||
| Maintenance burden | 10% | ? | ? | ||
| Security/compliance | 10% | ? | ? | ||
| Total | 100% | Σ | Σ |
Scoring guide: 1 = Very poor, 2 = Poor, 3 = Acceptable, 4 = Good, 5 = Excellent
Lưu ý: Adjust weights theo context của project. Startup ưu tiên time-to-market, enterprise ưu tiên security/compliance.
Total Cost of Ownership (TCO) Calculation
Build Cost
TCO_Build = Development + Maintenance + Infrastructure + Opportunity
Development:
- Developer hours × hourly rate
- Testing và QA effort
- Documentation
- Security audit
Maintenance (annual):
- Bug fixes: ~20% development cost/năm
- Feature updates: ~15% development cost/năm
- Security patches
- Dependency updates
Infrastructure:
- Servers, database, monitoring
- CI/CD pipeline
Opportunity Cost:
- Thời gian team KHÔNG làm features mang lại revenue
- Delayed time-to-market impact
Buy Cost
TCO_Buy = Licensing + Integration + Customization + Migration Risk
Licensing (annual hoặc per-usage):
- Base subscription
- Per-user/per-transaction pricing
- Tier upgrades khi scale
Integration:
- Development effort connect với existing system
- Data migration
- Training cho team
Customization:
- Workaround cho features thiếu
- Custom plugins/extensions
Migration Risk:
- Cost chuyển sang vendor khác nếu cần
- Data export complexity
- Contract lock-in penalty
TCO Comparison Template
Build Buy (Vendor X)
─────────────────────────────────────────────────────
Year 1
Development/Setup $80,000 $15,000
Licensing $0 $24,000
Infrastructure $6,000 $0 (included)
Training $2,000 $3,000
Year 2
Maintenance $16,000 $0
Licensing $0 $24,000
Feature updates $12,000 $0 (included)
Infrastructure $6,000 $0
Year 3
Maintenance $16,000 $0
Licensing $0 $30,000 (price increase)
Feature updates $12,000 $0
Infrastructure $6,000 $0
─────────────────────────────────────────────────────
3-Year Total $156,000 $96,000
Opportunity cost $40,000 $5,000
─────────────────────────────────────────────────────
Adjusted Total $196,000 $101,000
Case Study 1: Authentication - Build vs Auth0/Azure AD B2C
Context
E-commerce platform cần user authentication cho 50K users, cần MFA, social login, password reset.
Analysis
| Criteria | Build (ASP.NET Identity) | Auth0 | Azure AD B2C |
|---|---|---|---|
| Time to market | 6-8 tuần | 1-2 tuần | 1-2 tuần |
| Cost/năm (50K users) | ~$30K dev + maintenance | ~$2,760 (Essential plan) | ~$1,500 (50K auth/month) |
| Customization | Full control | Extensive (Actions, Forms) | Moderate (custom policies XML) |
| MFA support | Build from scratch | Built-in, nhiều options | Built-in |
| Social login | Build per provider | 30+ providers sẵn | Limited providers |
| Security expertise | Team phải tự handle | Auth0 team chuyên sâu | Microsoft security team |
| Vendor lock-in | None | Medium (user store ở Auth0) | Medium (Azure ecosystem) |
| Compliance (SOC2) | Tự audit, rất tốn kém | Auth0 đã certified | Azure đã certified |
Decision
Buy (Azure AD B2C) cho project này vì:
- Auth là solved problem, không phải competitive advantage
- Security risk quá cao khi tự build (password storage, MFA, brute force protection)
- Compliance requirement cần SOC2 - tự build audit tốn $50K+
- Team 4 devs không nên spend 8 tuần cho auth khi có 6 tháng deadline
Khi nào nên Build auth
- Product chính là identity/auth (IAM vendor)
- Yêu cầu custom auth flow cực kỳ đặc biệt
- On-premise requirement không cho phép cloud service
- Budget cực kỳ hạn chế và scale nhỏ (< 1K users)
Case Study 2: Email Service - Build vs SendGrid
Analysis
| Criteria | Build (SMTP + Template Engine) | SendGrid |
|---|---|---|
| Setup time | 2-3 tuần | 1-2 ngày |
| Deliverability | Low (IP reputation mới) | High (established IP pools) |
| Cost (100K emails/month) | Server $50 + dev time | ~$20/month (Essentials plan) |
| Bounce handling | Build custom | Built-in + webhooks |
| Analytics | Build custom dashboard | Built-in (open, click, bounce rates) |
| Template management | Build CMS hoặc hardcode | Visual editor + API |
| Compliance (CAN-SPAM) | Tự implement | Built-in unsubscribe handling |
Decision
Buy (SendGrid) - email delivery là commodity, deliverability là hard problem (IP warming, SPF/DKIM, bounce management). Cost $20/month vs hàng tuần dev time.
Khi nào nên Build
- Send volume cực lớn (millions/day) - cost SendGrid tăng nhanh
- Email là core product (email marketing platform)
- Data sensitivity không cho phép third-party process
Case Study 3: Search - Build vs Elasticsearch/Azure Cognitive Search
Analysis
| Criteria | Build (SQL Full-Text) | Elasticsearch (Self-hosted) | Azure Cognitive Search |
|---|---|---|---|
| Setup time | 1 ngày | 1-2 tuần | 2-3 ngày |
| Full-text search quality | Basic | Excellent | Excellent |
| Fuzzy search, synonyms | Limited | Rich analyzers | Rich analyzers |
| Faceted search | Manual (slow) | Built-in aggregations | Built-in facets |
| Auto-suggest | Build custom | Completion suggester | Built-in |
| Ops complexity | None (SQL Server) | High (cluster management) | None (managed) |
| Cost | Free (existing SQL) | $200-500/month (3-node) | $250+/month |
| Scale | Limited | Excellent | Excellent |
| Vietnamese language | Poor | ICU plugin + custom | Limited |
Decision Framework
- < 100K documents, basic search → SQL Full-Text Search (free, good enough)
- 100K-10M documents, need advanced search → Elasticsearch hoặc Azure Cognitive Search tuỳ team ops capability
- Vietnamese text search → Elasticsearch với custom Vietnamese analyzer
Risk Assessment Template
markdown## Risk Assessment: [Build/Buy Decision Name]
### Vendor Risks (for Buy)
| Risk | Likelihood | Impact | Mitigation |
|------|-----------|--------|------------|
| Vendor goes out of business | Low | Critical | Abstract behind interface, data export plan |
| Price increase > 50% | Medium | High | Contract negotiation, alternative vendor POC |
| Service outage | Medium | High | Fallback mechanism, SLA with penalties |
| Feature gap | Medium | Medium | Evaluate roadmap, workaround plan |
| Data residency violation | Low | Critical | Verify region, contractual guarantees |
### Build Risks
| Risk | Likelihood | Impact | Mitigation |
|------|-----------|--------|------------|
| Underestimate dev effort (2-3x) | High | High | Spike/POC trước khi commit |
| Key developer leaves | Medium | Critical | Documentation, knowledge sharing |
| Security vulnerability | Medium | Critical | Security review, penetration test |
| Maintenance becomes burden | High | Medium | Define maintenance budget upfront |
| Scope creep | High | Medium | Fixed scope v1, strict prioritization |
Checklist Ra Quyết Định
Trước khi quyết định Build
- Đã estimate realistic (thêm 50-100% buffer cho unknowns)?
- Có ít nhất 2 người trong team có expertise domain này?
- Feature này có phải competitive advantage không?
- Đã tính maintenance cost cho 3 năm tới?
- Team có bandwidth không bị ảnh hưởng core features?
Trước khi quyết định Buy
- Đã POC/trial với real use case (không chỉ demo)?
- Đã đọc kỹ pricing model (hidden costs, overage charges)?
- Đã evaluate ít nhất 2 vendors?
- Exit strategy rõ ràng (data export, migration path)?
- Vendor có SLA phù hợp với business requirement?
- Abstract behind interface để có thể swap vendor sau?
Golden Rules
- Không build nếu không phải core competency - auth, email, payment processing hầu hết nên buy
- Không buy nếu vendor control critical path - nếu vendor outage = business stop hoàn toàn
- Luôn abstract - dù build hay buy, wrap behind interface để có thể thay đổi sau
- POC before commit - 1-2 ngày POC tiết kiệm hàng tháng sai lầm