Integrating Information Security Into The Technology Development Process

In a recent blog post, I discussed limitation of liability clauses in technology contracts. Given the favorable response to that post, I thought it would be of interest to discuss another misunderstood and frequently neglected area of technology contracting: information security warranties. Let me be more specific. Most well-drafted technology agreements contain specific warranties and other protections relating to the protection and security of data shared with the vendor. While clearly important, contract protections should not stop there. Rather, it is becoming a contracting best practice in the industry to also include one or more warranties specifically directed at ensuring the vendor has integrated information security into the overall development of its products. It is this area that is frequently overlooked and too often misunderstood.

These types of warranties try to address the problem of thoroughness in addressing information security whether the vendor is attempting to "bolt-on" security measures to an already developed product or has developed the product with information security in mind from the time of inception. In addition, these types of warranties are directed at ensuring the vendor hasn't incorporated orphaned code into its products.

Those of you who read this blog regularly will recall I previously provided a checklist of information security warranties, including the kind of warranties we are discussing today. Here, however, we will talk about the specifics of those warranties in detail.

Securing Development Warranties

In the current technology environment, it is...