New Delhi, India, November 14, 2014: BSA | The Software Alliance along with Data Security Council of India (DSCI), today announced the release of their latest study titled, “Security considerations in software procurement by government agencies in India”, undertaken in partnership with the. The study unveiled today by Mr. Anurag Singh Thakur, Chairman, Parliamentary Committee on IT, takes a detailed look at the Indian government’s and its various agencies’ existing software procurement policies and outlines global best practices for software procurement. It aims to help streamline the central and state governments’ procurement processes and encourage the use of properly licensed software to minimize security threats. Currently, a comprehensive legal framework or mandatory policy guidelines for driving software procurement by government agencies is absent. Central and state governments have evolved their own laws and regulations which treat the process of software procurement differently and often do not address security requirements.
“As we continue to digitize government services for increased transparency and convenient citizen services, the quantum of data and information residing with the government and its agencies has grown drastically. Maintaining data confidentiality and security has, thus, gained precedence,” said Anurag Singh Thakur, Chairman, Parliamentary Committee on IT. “We welcome this report by BSA, which presents recommendations to help streamline the government agencies’ procurement processes with special emphasis on security.”
“As an increasing number of government departments get connected, the complexity and scale of software deployed coupled with the Government’s spends on IT, are also on the rise. The quality of software used in mission critical systems and its role in maintaining high-levels of security, is crucial,” said Yolynd Lobo, India Director, BSA. “We, at BSA, believe that the using genuine software, procured from reliable sources is an essential first step that the government must implement to minimize exposure to data breaches and security threats.”
The study underscores a strong need to add security as one of the evaluation criteria for assessing software and/or software provider during the procurement process. Other recommendations include:
- The government should mandate incorporation of information security requirements in the procurement of software by government agencies including central and state agencies through an appropriate policy and legal framework.
- The government must include detailed security requirements in the RFI / RFP process for procuring software.
- Assess software security through its entire lifecycle from design and development to testing and maintenance against international standards
- Eliminate counterfeit and unlicensed software from the software supply chains to reduce security vulnerabilities
- Create a Centre of Excellence (CoE) through the public-private partnership model to provide procedural and technical guidance to the government agencies vis-à-vis addressing software security risks and meeting the legal or regulatory requirements
- Increase awareness on the benefits of procuring legitimate software and using secure software lifecycle management; software supply chain issues, risks, solutions, standards, guidelines and best practices.
R. Chandrashekhar, President of NASSCOM, said, “As government services move to electronic platforms, software has taken a central role. Evaluating software from a security standpoint during procurement is imperative. It is promising to see the government’s willingness to adopt security best practices to avoid data breaches. I hope the government will find our recommendations useful and mandate incorporation of security requirements in its procurement processes.”
“In a worsening global threat landscape, it is heartening to see that the government departments and agencies understand information security requirements for addressing security risks. They are aware of the need to continuously adopt best security practices and technologies to keep pace with the new attack vectors that are rapidly emerging. I hope the government will find this report and our recommendations for the ‘software procurement lifecycle’ from the security point of view, useful”, said Kamlesh Bajaj, CEO of DSCI.
The study findings are based on background research coupled with expert inputs from senior government officials across various government departments and agencies, consultants, vendors and system integrators.