This question really goes back into risk management, and I'm not even talking about risk management derived from information security management.
I'm talking about project management risk management. A lot of companies have a PMO (project management office) but fewer have project risk experts in them.
When scoping out a project, such as outsourcing identity management to a vendor's product, such as RSA SecurID -- project risk managers would say, "how much should we put into this single vendor solution?" -- not from a security perspective, but merely from a "run the business" perspective.
In my mind, when a large company goes to purchase a product and roll it out (this applies to outsourcing and cloud computing, including SaaS, as well) there is the notion not to put all your eggs in one basket. If your primary vendor goes away -- how easy it is to move to a secondary or tertiary vendor?
When planning -- it is easy to just look at cutting up providers/vendors into percentages and overfill. If you have a solution that is 100 percent in house, considering adding one external solution that will fill a 20 percent gap. Then, add another provider for another 20 percent -- a 40 percent outside solution. Determine which provider is most worthwhile of the two after some performance accounting (and probably financial accounting) analysis, as well as your own internal audit performance and business metrics around said product.
If one solution sticks out -- tap on another 20 percent, and if they behave well over another time period (a cycle, or iteration, of six sigma), add a final 20 percent. Then you have two providers -- one at 20 percent, one at 60 percent (and 20 percent still in-house). As a final move, add a third provider/vendor solution at 20 percent (for a fully outsourced solution). However, retain your ability to fall back to your 20 percent solution if need be for a certain time period. See how they perform. Using your second and third providers -- see if either of them can take on another 20 percent (like your first provider did) during trial runs. If they pass, perform failure scenarios where you drop your primary provider down to 40 percent and let the secondary or tertiary provider take on that additional 20 percent for a period of time. Analyze using your metrics and six sigma tools how the secondary and tertiary providers perform -- and shift around the numbers if your primary provider is failing you.
In the long run -- you'll be able to quickly move from one solution point to another -- and potentially even back to an in-house solution. This isn't just information security management, risk management, or disaster recovery / business process operations. It's good project management practice!