DISQUS

evince blog: evince passes security audit

  • Stefan Foster · 1 year ago
    I would like to point out the fact that no source code will be held with "National Computing Centre" and we are a little unhappy/concerned that you do not seem to be aware or know who you are storing your source code with. The escrow company you refer to has not been part of our organisation for nearly 10 years and can no longer be mandated for as they have no connection to central or local government.
  • ps source · 1 year ago
    Overlooking escrow services in the procurement
    process can be risky now that business continuity and
    sustainability are high on the agenda. For the last 20
    years, there has been no effective specialist ICT
    escrow provider to compete with NCC Group.
    However, recent changes have acted as a catalyst:
    the NCC Group has been transformed from a quasi-
    government body to a privatised plc, becoming fully
    listed on the London Stock Exchange in July 2007.
    Since NCC is now a private company you can no
    longer mandate for its use and most standard form
    government contracts are now prescribing “a
    reputable escrow provider” as opposed to specifying
    NCC Group. OGC guidance is that NCC Group must
    now be treated as any other private organisation and
    as such must not be stipulated in public contracts. So
    now we have a choice, but in a recent survey 95% of
    local authorities and software companies were
    unaware of any escrow providers other than NCC.
    Where can you go for an alternative? Your software
    supplier may have an existing multi-user agreement
    with the NCC and initially may be reluctant to set up a
    new one, though the same survey found 95% of
    clients and software companies would be open to
    using an alternative escrow provider.
    Some organisations opt for using a bank, but this
    rarely provides more than a vault service. Checks that
    the media are readable and material is complete are
    essential if the escrow is to have any real value.
    We have identified several possible alternative
    suppliers. As you would expect in a market which
    was effectively a monopoly until very recently, new
    entrants are competing both on price and on service.
    One alternative supplier, for example, offers an online
    management system and claims it has a strong
    following in local government because of its ability to
    cover key local government software applications.
    In the context of on-going financial pressures it is
    worth re-considering existing escrow arrangements
    too. One alternative supplier claims that an authority
    holding five to ten software applications in escrow
    could save around £3,000 without risk of detriment to
    service levels. It is also important to check that any
    escrow provider has sufficient professional indemnity
    cover, just in case.
    For more information on how Socitm Consulting
    can help you in this area, please email us at
    consulting@socitm.gov.uk or call 0845 450 0904.
    Escrow Services - choice is now compulsory
  • Mark Cheverton · 1 year ago
    Stefan,

    Thanks very much for clarifying this. I have to point out that this wasn't Giles' mistake, but one I introduced upon proofing which I'm sure I will not hear the end of in the office!

    OL has worked with NCC to hold the iChIS source code over the past few years, and are very happy with the service which is why we've worked with them to provide this facility for evince. Howvere, as both comments have pointed out, should a customer require an alternative provider of escrow services we are happy to meet this requirement and you should make sure you're totally happy with any service offered before ticking the escrow box in your procurement.