Assess the security impact of acquired software including commercial-off-the-shelf, open source, third-party, and managed services.

A logistics firm acquires a niche route-optimisation product from a small third-party software vendor. During contract negotiations the vendor refuses to provide source code, citing intellectual property concerns, but offers other forms of assurance. The security manager must recommend the strongest mechanism to protect the firm if the vendor later fails or stops supporting the product. What should the security manager recommend?

• AInsist on a perpetual licence at no additional cost so the firm can continue running the existing binary indefinitely regardless of vendor status.
• BRequire a source code escrow arrangement with a reputable agent and clearly defined release conditions tied to vendor insolvency or material support failure.check_circle Correct
• CAccept an extended warranty that doubles the standard support period from one to two years in exchange for the firm signing a multi-year agreement.
• DRequest that the vendor agree to share the source code only after a confirmed exploit in the product has been actively used against the firm.

Why A is wrong: Tempting because a perpetual licence preserves use rights, but it does not address security patching, dependency updates, or operating-system compatibility once the vendor is no longer maintaining the binary, so the security posture decays even while use is permitted.

Why B is correct: Correct because a properly drafted escrow with explicit release triggers gives the acquirer a contractual route to obtain source for ongoing maintenance and security fixes if the vendor fails, balancing the vendor's IP concerns with the acquirer's continuity risk.

Why C is wrong: Tempting because a longer warranty improves short-term support, but it does nothing if the vendor goes out of business inside the warranty period, leaving the firm without source, patches, or remedy when it most needs them.

Why D is wrong: Tempting because it ties the release to a tangible event, but waiting for confirmed exploitation guarantees damage before remedy is available, and an active incident is the worst possible moment to start onboarding a new code base.