In a software project, a software vendor is responsible to deliver a piece of software. Everything else, including the infrastructure setup, database and application server installation/configuration/maintenance, etc. are not the responsibility of the software vendor.

Contractually, the software vendor is to provide BCP (business continuity plan) and DRP (disaster recovery plan) documents.

The question is, which sections in these documents are the responsibility of the software vendor? In other words, which parts of the BCP/DRP documents are solely related to the software delivered, rather than the infrastructure setup/installation/configuration/maintenance?

  • Why is it up to the software vendor to provide these things? I think you're starting from a flawed premise.
    – Steve
    Dec 20 '13 at 3:59
  • @SteveS: I totally agree with you, but I'm not in a position to change the premise. The project has been there for like a decade, and most premises are previously laid down. I've been only recently invited as a security consultant---another wrong decision, as it's very hard to "add" security to a system. Given the current situation, is it possible to answer the question? Dec 20 '13 at 18:17
  • I don't think there's a one-size-fits-all answer. I think you'll have to sit down with the vendor and hash it out in a contract.
    – Steve
    Dec 20 '13 at 19:33
  • @SteveS: That's what we want to do. The question is, what parts of of the BCP/DRP plan can be imposed on the application itself? I'm not after a one-size-fits-all answer; a few examples will clear the fog. Dec 20 '13 at 21:21

Read The Contract.

You didn't say whether you are the vendor or the buyer. If the contract wasn't drafted well enough to protect you, fire your lawyer. (For legal advice consult a licensed attorney.)

I don't see how any complete DR plan can possibly be written without knowledge of the infrastructure, operating environment, etc.

If you find yourself in a position where you are the software vendor, and you are stuck writing these documents, you will have to elicit the relevant information from your customer. You might want to CYA and fully document all contacts with the customer so that, if you are unable to obtain the information you need, you will have a record that you tried.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.