Iron Mountain Digital Authority

escrow] for loss of support than for bankruptcy,” says Boruvka. That loss could come about due to some fairly common circumstances—an irreparable software glitch, the loss of key programmers, a merger or acquisition that changes the company’s product direction, even a hurricane that disables the vendor’s support center.

According to the survey, the majority of respondents (59 percent) say that their critical applications are most often placed in escrow; 51 percent say it’s their complex, hard-to-replace applications; and 48 percent point to applications that are expensive to replace.

“People naturally gravitate toward applications that are costly and big, but a process is necessary by which IT and legal work with the business owners to determine how the software impacts the business,” says Boruvka. For example, consider that relatively inexpensive application with huge business implications, or that seemingly less-critical application that would be impossible to re-create given all the customization that’s gone into it.

To verify or not to verify

An escrow deposit is a great first step in ensuring

VERIFICATION SERVICES: “TRUST, BUT VERIFY”

When it comes to the safeguarding of technology investments, former President Ronald Reagan may have said it best: “Trust, but verify.”

With critical business technology, an escrow may not be enough. “That’s because the inherent value of the escrow arrangement is seriously compromised if the escrow materials are incomplete,” says Shane Ryan, manager of Verification Services for Iron Mountain’s Intellectual Property Management group. CIOs need assurances that they’ll be able to hit the ground running if or when that escrow deposit has to be deployed, so they need to be able to read, re-create and maintain the technology in-house. In other words, they must be able to “step into the shoes of the vendor,” he explains, and get that software going with as little service interruption (and capital outlay) as possible.

But without some kind of verification of the deposit, the odds are stacked against that happening. In fact, the vast majority of deposits turn out to be incomplete. “Incomplete deposits result in higher costs associated with replacing software, additional costs stemming from consultant fees and personnel hires, and even court and arbitration fees,” Ryan says. In addition, there’s the potential loss

in revenue, customer dissatisfaction and brand deterioration that come with even the slightest hiccup in service delivery.

Avoiding all that is simple: Engage verification services with escrow deposits, especially around mission-critical applications. There are several levels of verification from which to choose:

LeveL One Inventory. An inventory of the escrow validates whether the information necessary to re-create a “depositor’s development environment” is indeed in the deposit. Testing includes analyzing readability, scanning for viruses, identifying build instructions and identifying materials required for development.

LeveL twO Compile test. A deeper dive involves a test to compile the deposit and build code. This includes all the steps in an inventory, plus re-creating the development environment, compiling source files, re-creating executable code and creating build instructions.

LeveL three
Binary Comparison. Another layer of
testing entails a comparison of the
files built from the compile test to
actual production technology. This

ensures a full match in file size.

LeveL fOur
usability test. The final layer in veri-
fication services confirms that the
functionality of the deposit material
is usable. Here, the software is actu-
ally compiled into a true production
environment (or a very similar test
situation) to ensure the software will
work properly when installed.

In terms of selecting what level of verification is appropriate, CIOs can build the right program for specific deposits. “Complex, costly applications that impact the business likely warrant all four levels of verification,” Ryan says, “while some less-critical applications may require a simple inventory check.” (Some level of verification is always recommended for all escrow deposits.)

The important thing to remember is that any disruption in the critical applications upon which the business relies so heavily could have disastrous and spiraling effects. “Therefore, it makes good business sense to take escrow arrangements a step further and include verification services,” says Ryan. “After all, what good comes of a technology escrow that can’t be used readily —or affordably—in a production environment?”