Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In a software project, a software vendor is responsible to deliver a piece of software. Everything else, including the infrastructure setup, database and application server installation/configuration/maintenance, etc. are not the responsibility of the software vendor.

Contractually, the software vendor is to provide BCP (business continuity plan) and DRP (disaster recovery plan) documents.

The question is, which sections in these documents are the responsibility of the software vendor? In other words, which parts of the BCP/DRP documents are solely related to the software delivered, rather than the infrastructure setup/installation/configuration/maintenance?

share|improve this question
    
Why is it up to the software vendor to provide these things? I think you're starting from a flawed premise. –  Steve Dec 20 '13 at 3:59
    
@SteveS: I totally agree with you, but I'm not in a position to change the premise. The project has been there for like a decade, and most premises are previously laid down. I've been only recently invited as a security consultant---another wrong decision, as it's very hard to "add" security to a system. Given the current situation, is it possible to answer the question? –  Sadeq Dousti Dec 20 '13 at 18:17
    
I don't think there's a one-size-fits-all answer. I think you'll have to sit down with the vendor and hash it out in a contract. –  Steve Dec 20 '13 at 19:33
    
@SteveS: That's what we want to do. The question is, what parts of of the BCP/DRP plan can be imposed on the application itself? I'm not after a one-size-fits-all answer; a few examples will clear the fog. –  Sadeq Dousti Dec 20 '13 at 21:21

1 Answer 1

Read The Contract.

You didn't say whether you are the vendor or the buyer. If the contract wasn't drafted well enough to protect you, fire your lawyer. (For legal advice consult a licensed attorney.)

I don't see how any complete DR plan can possibly be written without knowledge of the infrastructure, operating environment, etc.

If you find yourself in a position where you are the software vendor, and you are stuck writing these documents, you will have to elicit the relevant information from your customer. You might want to CYA and fully document all contacts with the customer so that, if you are unable to obtain the information you need, you will have a record that you tried.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.