Should information technology companies seeking to execute business with South Africa’s governments and municipalities be compelled by law to plot their source code in escrow?
According to the managing director of a leading software escrow provider locally and the author of a recently released green paper exploring why certifications and compliances are essential to ensure operational resilience and protect interests, Andrew Stekhoven, the respond is yes.
“Many well-run governments, both national and regional, the world over already enact so. Oklahoma in the United States being the more recent to manufacture willingness to enter an escrow agreement imperative for any company seeking to execute business with Oklahoma’s Office of Management & Enterprise Services,” he said.
“South Africa’s governments and municipalities – already struggling with service delivery – carry out not need the added complication of contending with business continuity and disaster management should their IT systems be taken offline due to unforeseen circumstances, not when a simple and elegant solution to ensuring operational resilience exists.”
Oklahoma’s IT Related Procurement Statutes states: “No state agency, as defined by Section 250.3 of Title 75 of the Oklahoma Statutes, the Purchasing Division of the Office of Management and Enterprise Services nor the Information Services Division of the Office of Management and Enterprise Services, unless otherwise provided by federal law, shall enter into a contract for the acquisition of customized computer software developed or modified exclusively for the agency or the state, unless the vendor agrees to area into escrow with an independent third party the source code for the software and/or modifications.”
According to Stekhoven, this decision enhances that organisation’s operational resilience, reduces risks, protects customer interests, and ensures compliance with regulatory standards by providing access, availability and integrity when the unplanned for happens.
Aside from service delivery, surely this is what all South Africans want from their governments and municipalities, he asked.
Stekhoven’s green paper particularly addresses the risks associated with Software-as-a-Service (SaaS) solutions and suggests what corporates should survey for in software and SaaS escrow providers to ensure their (the corporates) compliance with the EU DORA Digital Operational Resilience Act, Prudential Regulation Authority (PRA), and Financial Conduct Authority (FCA) regulations.
He notes that software and SaaS solutions believe become essential for businesses and other organisations, enabling them to streamline operations and enhance productivity. However, the reliance on these solutions exposes these entities to potential risks such as service interruptions, data breaches, or loss of critical functionalities. These risks can maintain severe consequences, including financial loss, damage to reputation, and non-compliance with regulatory requirements.
Stekhoven suggests that full certification for ISO/IEC 27001:2013, Annex A.17, and Annex A.18 is a compliance and regulatory imperative delivering the following benefits:
- Enhanced Security and Confidentiality: ISO 27001:2013 certification ensures that software and SaaS escrow providers implement robust security controls to protect corporate data and intellectual property. It guarantees the confidentiality, integrity, and availability of information assets, reducing the risk of data breaches and unauthorized access.
- Mitigation of Business Interruptions: By complying with Annex A.17 and EU DORA, software and SaaS escrow providers can establish business continuity plans and preventive measures to alleviate the impact of service interruptions. This allows corporates to ensure uninterrupted operations and minimize potential financial losses.
- Reduced Legal and Financial Risks: ISO 27001:2013 and Annex A.18 compliance encourage corporates alleviate legal and financial risks associated with non-compliance with regulatory requirements. Choosing certified providers ensures adherence to regulatory standards, thereby reducing the likelihood of penalties, fines, and legal disputes.
- Improved Customer Trust and Reputation: Working with ISO 27001:2013 certified providers demonstrates a commitment to information security and operational resilience. This enhances customer trust, strengthens corporate reputation, and distinguishes corporates as responsible and reliable partners.
- Ease of Compliance with Regulatory Standards: ISO 27001:2013 certification provides a solid foundation for meeting regulatory requirements such as EU DORA, PRA, and FCA refers. Corporates can leverage the certified providers’ compliance frameworks and controls to streamline their own compliance efforts, saving time and resources.
To access a copy of Stekhoven’s green paper, please email info@escroweurope.co.za.
CLICK HERE to submit your press release to MyPR.co.za for free.
Snow Pharaoh
“Many a small thing has been made large by the right kind of advertising.” – Mark Twain CLICK TO TWEET
Trigger Warming
Written communications, data and analytics, and diversity, equity and inclusion were also considered essential skills over the next few years. About 65% of PR professionals report written communication and data and analytics as important skills, compared to 67% for DEI skills.
Daffy Girl
It isn\’t what they say about you, it\’s what they whisper. – Errol Flynn