Offering regional and national programs, CIO (and CSO) events bring together some of the most respected names and thought leaders in information technology and security. Presented by CIOs and other senior level executives, these invitation-only programs offer timely topics and strong networking. Learn More »
Social Responsibility's Strategic Benefits
December 15, 11:30 AM - 12:30 PM US/Eastern (GMT-5)
Join Ed Granger-Happ, CIO of Save the Children, for a discussion of how creating an organization that is socially responsible improves staffing, retention, leadership development and overall corporate health.
Working With and Communicating to Your Board of Directors
January 13, 2009, 4:00 PM - 5:00 PM US/Eastern (GMT-5)
CIO panelists who will share tips and experiences working with their boards: Twila Day of SYSCO; Jeff O'Hare, West Corp.; Marc West, formerly with H&R Block.
IT's Role in Growing Mid-Market Companies
January 14, 4:00 PM - 5:00 PM ET (GMT-5)
Mid-market Council members will share their companies' stories and challenges in driving or coping with growth. Panelists represent Veterinary Pet Insurance, Medicis Pharmaceutical, and Intrax Cultural Exchange.
Learn more about the CIO Executive Council »Apply today for a FREE subscription to CIO Magazine!
February 25, 2008 — CIO — Growing up, mothers train their children to resist mindlessly following their peers by asking the glib question: "If your friend jumped off a bridge, would you?" This simple question is packed with insight. Independent thought that questions others' habits, beliefs and actions is a hallmark of maturity. However, today's business culture sometimes fails this childhood test.
Take source code escrow. Without truly considering it, many organizations have a standing policy to require software developers to escrow source code of products the organization is licensing. If organizations would carefully analyze the risk/return investment, the business case for source code escrow arrangements would almost always come up negative. Dealmakers and lawyers spend countless hours negotiating escrow terms and conditions and pay escrow agents like Iron Mountain thousand of dollars to maintain the escrow account. This time and money is often a wasted investment, as the potential benefits are marginal. Customers should be skeptical of expending valuable time and money on an arrangement that is largely ineffective at accomplishing the very purpose for which it was created. Before explaining why, let's first discuss what software source code escrow is and why it has become a common part of many software transactions.
Every day, companies around the world license and implement custom software applications that are critical to the operation of their businesses. Development and implementation can cost millions of dollars. Because these applications are critical, software development and maintenance contracts often require the software developers to store the "source code" of the software and explanatory documentation in an escrow account. Source code is the sequence of logical statements and operations written in a human-readable computer programming language that controls the processing of data and the functionality of software. The source code itself can be hundreds of thousands of lines of code and is normally designed and written by software programmers in programming languages such as C++, Java or Visual Basic. When completed, the source code is compiled into "executable code" that can be downloaded, installed and run on a computer. However, with only the executable code, customers have no ability to see how the software is processing data or performing functions and, for the most part, have no ability to change the operation of the software.
Because repairing problems or changing functionality is only possible with the source code, the escrow of source code is common in large software transactions involving custom developed or operationally critical applications. In a source code escrow arrangement, the source code and documentation are held in escrow by a trusted third party, the escrow agent. The source code and related documentation are to be released upon the occurrence of a "release event" such as the software developer filing bankruptcy or failing certain obligations under the license.
Following a release event, the promise of a source code escrow is that the customer can obtain the code to maintain the software without the original developer. This maintenance involves fixing bugs, ensuring compatibility with other system upgrades and adding the functionality required in the customer's changing business.
Software maintenance is essential to enterprise applications. Because the customer has no assurance that the software developer will always be around to perform software maintenance, and since such maintenance cannot be performed without the source code, escrow is considered a necessary part of certain software deals.
For the reasons described above, escrowing source code of critical business software seems to be a prudent business decision for customers. However, for various reasons, the time, legal fees and other resources spent establishing and maintaining escrow accounts provide little protection for the customer.
1. Only a Small Percentage of Escrows Is Ever Released
Iron Mountain, the dominate escrow agent in the United States, has thousands of escrow accounts and more than 45,000 customers worldwide that have stored their software and intellectual property with Iron Mountain, including over 75 percent of the Fortune 500. Over the 10-year period from1990 to 1999, Iron Mountain released 96 escrow accounts, less than 10 per year. While it is unclear how many are typically released in a given year, these low release rates indicate that only rarely does a release event occur and, when it does, customers often realize it is easier to find an alternative software provider.
2. Most Escrowed Source Code Is Defective
While some customers may view a source code escrow as an insurance policy to protect themselves in the slight chance that a release event occurs, often source code escrows fail to provide adequate protection because, upon release, the source code is frequently outdated, defective or otherwise fails to meet the customer's needs. According to Iron Mountain, 97.4 percent of all analyzed escrow material deposits have been found incomplete and 74 percent have required additional input from developers to be compiled.
Take, for example, what happened to Radisson Hotels Worldwide. Several years ago, Radisson hired a third-party software company to maintain its mission-critical reservation system. The software vendor agreed to escrow the Radisson software code. The code was eventually released as a result of the software vendor going out of business. But upon release, Radisson found that the source code in escrow could not even perform the fundamental and critical task of booking guests at Radisson's hotels. The released code was missing many components and the escrow account did not contain any documentation developed after the initial escrow of the software. This unfortunate discovery is not atypical in source code escrow arrangements, especially when the customer has not been vigilant in continually monitoring and auditing what is being stored with the escrow company.
Just the basics, please. Sometimes we all need a refresher or we need to make sure our team and our colleagues are all on the same page.
Over 25 tutorials on everything from business intelligence to virtualization.