To mitigate the impact of a software vendor going out of business, a company that uses vendor
software should require which one of the following?

A.
Detailed credit investigation prior to acquisition.

B.
Source code held in escrow.

C.
Standby contracts with other vendors.

D.
Substantial penalties for breech of contract.’

Explanation:
The original answer was C however this is incorrect for this case. SLA and standby are good ideas but
in this case B is right. “A software escrow arrangement is a unique tool used to protect a company
against the failure of a software developer to provide adequate support for its products or against
the possibility that the developer will go out of business and no technical support will be available
for the product….Under a software escrow agreement, the developer provides copies of the
application source code to an independent third-party organization. The third party then maintains
updated backup copies of the source code in a secure fashion. The agreement between the end user
and the developer specifies “trigger events”, such as the failure of the developer to meet terms of a

service level agreement (SLA) or the liquidation of the developer’s firm.” – Ed Tittle CISSP Study
Guide (sybex) pg 550