When CIOs think about utility computing in general or software-as-a-service (SaaS) in particular, two things make them very nervous. The first is data security. The second is service reliability. The fears about security and reliability may be rational or not – usually, they’re a little of both – but they’re real, and the onus is on suppliers to allay them. No trust, no business.

It’s against that backdrop that Salesforce.com’s outage this week – its second in as many months – should be viewed. It’s a big deal, not just for Salesforce but for the nascent SaaS industry. Dan Farber and his blogmate David Berlind have both done a good job of focusing attention on the right questions here. Farber points out that some of Salesforce’s customers don’t think the outage was “minor,” as the company’s CEO Marc Benioff termed it. If it’s going to keep the trust of current users and earn the trust of potential new ones, Salesforce needs to be upfront about what happened, why it happened, and what the company’s doing to ensure it doesn’t happen again. As Farber writes, “Salesforce.com should be transparent – providing specifics – about any reliability issues.” No system is 100% reliable, and I believe the SaaS model will ultimately prove to be considerably more reliable than the on-premise model, but obfuscation about an outage may end up doing more harm to a SaaS provider than the outage itself.

Berlind’s post shows why. He writes that Salesforce’s two outages raise “the very fair question” of whether or not SaaS “is ready for the mission critical needs of enterprises.” He notes further that “we don’t have to look back very far for a public reminder of the PR nightmare that could follow when a company overpromises reliability and underdelivers.” By not being clear about the reasons for the service failure, Salesforce invites such skepticism from the press. If the press turns against the SaaS model, building the necessary trust to expand that model will become much, much more difficult.

Salesforce’s outages raise another issue as well – one that will play a critical role in determining the structure of the enterprise IT business in the years ahead. Salesforce has chosen to maintain its own computing infrastructure privately. It not only develops, sells, and services the application, but it owns and maintains the server and storage hardware on which the application runs. It recently invested, in fact, in building two major new data centers. Other SaaS providers, including Salesforce competitor RightNow Technologies, have taken a different route. They don’t own and maintain their own data centers but rather draw on the computing infrastructure of third-party utilities.

Which route is the better one? It’s difficult to say definitively. But I think that in the end application utilities will be run separately from infrastructure utilities. They’re very different businesses after all, with the application business being innovation-intensive and the infrastructure business being capital-intensive. It’s hard for any company to be great at two different businesses simultaneously.

It may have made sense for Salesforce to control its infrastructure when it was starting out, but its recent hiccups raise the question of whether the company and its customers will continue to be best served by the dual-focus strategy. It’s a critical question, given the fact that for a SaaS provider a sustained case of the hiccups could well be lethal.