evince blog - Latest Comments in evince passes security audit

Re: evince passes security audit

Used Transmission — Fri, 29 Oct 2010 13:04:35 -0000

This is the great blog, I'm reading them for a while, thanks for the new posts!

Re: evince passes security audit

Mark Cheverton — Wed, 11 Jun 2008 16:01:56 -0000

Stefan,

Thanks very much for clarifying this. I have to point out that this wasn't Giles' mistake, but one I introduced upon proofing which I'm sure I will not hear the end of in the office!

OL has worked with NCC to hold the iChIS source code over the past few years, and are very happy with the service which is why we've worked with them to provide this facility for evince. Howvere, as both comments have pointed out, should a customer require an alternative provider of escrow services we are happy to meet this requirement and you should make sure you're totally happy with any service offered before ticking the escrow box in your procurement.

Re: evince passes security audit

ps source — Wed, 11 Jun 2008 03:56:07 -0000

Overlooking escrow services in the procurement
process can be risky now that business continuity and
sustainability are high on the agenda. For the last 20
years, there has been no effective specialist ICT
escrow provider to compete with NCC Group.
However, recent changes have acted as a catalyst:
the NCC Group has been transformed from a quasi-
government body to a privatised plc, becoming fully
listed on the London Stock Exchange in July 2007.
Since NCC is now a private company you can no
longer mandate for its use and most standard form
government contracts are now prescribing “a
reputable escrow provider” as opposed to specifying
NCC Group. OGC guidance is that NCC Group must
now be treated as any other private organisation and
as such must not be stipulated in public contracts. So
now we have a choice, but in a recent survey 95% of
local authorities and software companies were
unaware of any escrow providers other than NCC.
Where can you go for an alternative? Your software
supplier may have an existing multi-user agreement
with the NCC and initially may be reluctant to set up a
new one, though the same survey found 95% of
clients and software companies would be open to
using an alternative escrow provider.
Some organisations opt for using a bank, but this
rarely provides more than a vault service. Checks that
the media are readable and material is complete are
essential if the escrow is to have any real value.
We have identified several possible alternative
suppliers. As you would expect in a market which
was effectively a monopoly until very recently, new
entrants are competing both on price and on service.
One alternative supplier, for example, offers an online
management system and claims it has a strong
following in local government because of its ability to
cover key local government software applications.
In the context of on-going financial pressures it is
worth re-considering existing escrow arrangements
too. One alternative supplier claims that an authority
holding five to ten software applications in escrow
could save around £3,000 without risk of detriment to
service levels. It is also important to check that any
escrow provider has sufficient professional indemnity
cover, just in case.
For more information on how Socitm Consulting
can help you in this area, please email us at
consulting@socitm.gov.uk or call 0845 450 0904.
Escrow Services - choice is now compulsory

Re: evince passes security audit

Stefan Foster — Wed, 11 Jun 2008 03:44:49 -0000

I would like to point out the fact that no source code will be held with "National Computing Centre" and we are a little unhappy/concerned that you do not seem to be aware or know who you are storing your source code with. The escrow company you refer to has not been part of our organisation for nearly 10 years and can no longer be mandated for as they have no connection to central or local government.