An enterprise financial institution relies on a custom, proprietary fraud detection application supplied by a niche third-party software vendor. During an annual supply chain risk assessment, the security team identifies a major operational risk: if the software vendor unexpectedly faces insolvency, goes out of business, or fails to maintain the application, the institution will lose the ability to update or fix critical bugs in the software. Which of the following risk mitigation provisions should the security team implement in the vendor agreement to directly resolve this continuity risk?
- A software escrow agreement requiring the vendor to deposit source code and build instructions with a neutral third party.Cevap
- BA service level agreement (SLA) establishing strict system uptime targets and financial remedies for unapproved downtime.
- CA business partner agreement (BPA) establishing shared financial liability and joint leadership oversight between both entities.
- DA non-disclosure agreement (NDA) containing strict confidentiality requirements and intellectual property protection terms.
Cevap
A software escrow agreement requiring the vendor to deposit source code and build instructions with a neutral third party.
A software escrow agreement directly mitigates third-party vendor bankruptcy and abandonment risk. Under this arrangement, the software vendor deposits the application source code, compile instructions, and documentation with an independent third-party escrow agent. If the vendor goes out of business or fails to meet contractual maintenance obligations, the escrow agent releases the code to the customer, enabling them to maintain and operate the software independently.
Adım Adım Çözüm
Anahtar Kavram
Software Escrow Agreements in Third-Party Risk Management