Thinking about tomorrow today

Transcription

1 Thinking about tomorrow today Depositing software source code with TÜV SÜD Software Escrow TÜV SÜD Product Service GmbH

2 Ideal for software suppliers and software users In order to manufacture products or services, it is often necessary to enhance procedures by having a bespoke software package. Whether it is a public authority or an innovative industrial enterprise there is always a dependence on the software that supports critical company operations. Software Escrow is the term used for a series of services connected with the secure storage of software source code. These services address two different target groups: Both target groups profit greatly from the benefits Software Escrow has to offer. All software is based on source code. If the software needs to be modified e.g., because legal terms or changes in the company (production processes, etc.) require it, then the source code is the key to any modification. Without access to the source code an update is impossible. 1. Software users/licensees Companies that acquire licenses for bespoke or modified software. 2. Software supplier/licensors Suppliers who develop software, that was ordered by a company, work as general contractors or adjust software to individual needs.

3 The source code The software source code is the original code of a computer program. This code is written in a computer language people can read. It is translated into an executable program by a compiler or interpreter. Since the source code has this special significance, the software supplier often insists on being the only one with access to the code. The source code is his business secret, his strictly guarded formula of success. This however creates a gap: As long as the contractual relationship between licensor and licensee is working well the gap is largely negligible, but what if the licensor is sold, goes out of business, or even goes bankrupt? If the ability to update or modify the software is lost then the financial risk lies with the licensee who has potentially invested a great deal of money money that could be irrevocably lost. The solution: TÜV SÜD Software Escrow TÜV SÜD Software Escrow closes this gap: Upon mutual agreement, TÜV SÜD stores the source code as soon as the contract between licensor and licensee is signed. Thus the source code is accessible if the software supplier can no longer update, develop, or maintain it. This ensures the continuity of the relevant business processes. Benefits for both contractual partners The terms under which TÜV SÜD makes the source code available to the licensee are contractually stipulated. TÜV SÜD functions as a neutral intermediary in this instance. The purpose of this mediation is to lead to definitions which clarify the conditions for delivering the code as precisely as possible. Benefits for the software supplier Customers have a clear security advantage by using TÜV SÜD Software Escrow. Potential customers can be assured with the quality of their products and services without disclosing their balance sheet. Strengthen competitive advantage. Protection of the intellectual property. Benefits for the software user Protected if the licensor stops trading with access to the source code. The requirements for uninterrupted updating, maintenance, and development of the software are fulfilled. Protection of IT investments. Minimizes economic risks and can improve BASEL II ratings.

4 Extensive experience as a performance measure With Software Escrow, TÜV SÜD assumes a neutral function as an escrow agent which leads to a win-win situation for both sides. However, as an independent service provider with extensive experience in the IT area to its credit, TÜV SÜD s Software Escrow offers a great deal more. In addition, TÜV SÜD can check the quality of the relevant software. The successful test is confirmed with a certificate. It authorizes the use of the TÜV SÜD certification mark for software quality. Software suppliers take advantage of this service to optimize the quality of their product and ultimately for marketing purposes. The service spectrum of TÜV SÜD Software Escrow Checking the source code when it arrives (completeness, agreement with the stipulations of the escrow agreement, readability, etc.) as well as physically storing it in special, suitable facilities (climate, fireproof environment, access control). Verification of the source code for operational application from sampling methods to complete verification. Software quality assurance, i.e., testing functionality, ergonomics and security of software systems, as well as consulting on requirements. Updating of the object in escrow (source code). Project-specific depositation, special models. You will find more on the topic of software quality at:

5 Different verifications A particularly important element of the TÜV SÜD Software Escrow services is the verification of the functioning of the source code. After all, a source code is only valuable if it is readable and able to restore the operational system. The extent to which verification takes place is determined in discussions with everyone involved. Essentially, the following is taken into consideration: Form of cooperation between licensor and licensee Business impact of the relevant software for the licensee TÜV SÜD Software Escrow offers a total of four steps for further verification. They build on one another, but Step 1 (standard receiving test) always has to be performed. All contracting parties involved receive comprehensive documentation of all the procedures, including all results. An audit of the production process for the material to be stored is also offered, which, when successfully completed, allows the use of a certification mark, confirming the relevant quality assurance standards have been met. Standard receiving test (requirement for deposit) Step 1 Static test (complement to Step 1) Step 2 Dynamic test (complement to Steps 1 and 2) Step 3 Special test (test according to special, individual criteria) Step 4

6 The steps of Software Escrow verification Step 1: Standard receiving test (requirement for secure storage) In many cases this step suffices for reliable software storage especially if the business partnership between licensor and licensee is established and trusted, and if the software supplier has built up a quality management system which also includes the storage process. Characteristics: Completeness Agreement with the stipulations of the storage agreement Agreement with the description of the object to be stored Readability of the data carriers Virus check Plausibility Step 2: Static test Complementary to Step 1, an expanded static test of the source code is performed. Characteristics: Application of software analysis methods, such as inspection, review, and walkthrough. Depending on the agreement, the department using the software may be present and actively involved in what is happening. The licensor can always be present, demonstrating an open and trusting working relationship. Step 3: Dynamic test Complementary to Steps 1 and 2, the dynamic test is offered. Characteristics: Performance of test compilations Generation of operational versions from the storage material for test purposes Step 4: Special test Test according to individual guidelines determined by the specific project situation and the particular form of cooperation with the licensor. Characteristics: Possible tests are, e.g., software test methods, comparison of versions, and individual combinations of Steps 1 to 3. Material of the licensee and the licensor may be taken into consideration. The presence and cooperation of the licensee and the licensor is always optional. With TÜV SÜD Software Escrow you generate trust as a licensor. As a licensee, TÜV SÜD Software Escrow gives you the security you need when acquiring and using software.

7 The process of Software Escrow verification Escrow process sequence SOFTWARE SUPPLIER Escrow agreement between supplier, user, and escrow agent. SOFTWARE USER Escrow agent checks the object to be stored and confirms to supplier and user that it is being stored. TÜV SÜD (escrow agent) Escrow agent checks the object to be stored and confirms to supplier and user that it is being stored. Supplier delivers the object to be stored to the escrow agent. Escrow agent manages the depot and takes care of updates. DEPOT In the event of a contractually stipulated reason for delivering the stored object, the escrow agent releases it to the user.

8 The Escrow sign as marketing instrument You may also use the Escrow sign for your communication. Thus you demonstrate that your source codes are escrowed safely. And you show your business partners that the escrow object has been verified reliably and escrowed with an approved agent. Our service portfolio We offer professional services, supporting you with: Certification of software quality Escrow services for depositing your software source code Testing of apps Certification of accounting software in accordance with GoBS (generally accepted principles of computerized accounting systems) Are you interested in further information on TÜV SÜD Software Escrow? Simply contact us. We will be pleased to answer your questions in a personal conversation. TÜV SÜD Product Service GmbH Phone: escrow@tuev-sued.de February 2013/07 EU