The Commonwealth may request that a supplier place its source code in an escrow that would be accessible by the state if certain events occur, such as a contractor’s bankruptcy. Escrow is usually not suitable for packaged, off-the-shelf software. In the current IT market, large contractors are less likely to provide customers with a source code escrow, while smaller contractors may be more likely to put their source code in escrow. If an agency determines that it needs the protection of a source code escrow, this requirement should be clearly stated in the RFP, including which party will bear the administrative costs of an escrow agreement or for collecting the source code.
There are risks if the supplier keeps the source code and delivers only the object code to the Commonwealth. The Commonwealth may need the source code at some point to avoid relying on the supplier for support and maintenance should the platform not perform or in the event the supplier goes out of business. In addition, auditors may need to access the source code to perform required audits. One solution is that the Commonwealth can create a source code escrow account whereby a trustee has control over a copy of the supplier’s source code. If the supplier goes out of business or bankrupt, the trustee may distribute the software to all of the supplier’s existing customers.