The UK Government has recently published an updated version of the National Risk Register and, as part of its assessment, has rightly recognised that critical software supplier failure represents a national resilience issue. The assessed likelihood of the insolvency of a critical supplier to the UK public sector – with the Government’s reasonable worst-case scenario specifically centred on a critical IT services supplier – has increased from 1–5% in the 2025 Register to 5–25% in the latest edition. That increased recognition should be welcomed. My concern is whether the response goes far enough at a software and service level, particularly when the Government’s assessment assumes that reasonable recovery measures are already in place.
Impact level
Despite the likelihood increasing, the Government continues to assess the overall impact as ‘limited’, something which deserves closer scrutiny. Many public sector organisations have never tested whether they could maintain access to critical software and services without the supplier they rely on. Others may lack the technical assets, knowledge or access required to execute their recovery plans when disruption occurs. This is where the distinction between supplier and service recovery becomes important.
The Government has established mechanisms for dealing with suppliers in financial distress, including Corporate Resolution Plans. From the available guidance, Corporate Resolution Plans appear primarily focused on managing failure at supplier level. That is certainly important, but protecting or restructuring a supplier does not necessarily guarantee continuity of every critical software service it provides.
Practical considerations
For organisations dependent on those applications, there are some immediate practical considerations. Can they continue accessing the software? Do they have the technical documentation and knowledge required to operate it? What happens to the data? If the supplier can no longer provide support, is there a tested route for keeping the application operational? These considerations must be addressed through Service Resolution Plans. Government guidance already recognises service-level continuity planning, but those plans need to be tested against realistic software supplier failure scenarios to establish whether the recovery mechanisms behind them will actually work.
Legal ‘step-in’ rights are a good example. Contractual rights to intervene following supplier failure can provide an important safeguard, but organisations also need the technical capability to exercise them. Without access to the necessary software assets, documentation and expertise, the limitations of those arrangements may only become apparent once a supplier has failed.
Decoding complexity
Modern software supply chains add another layer of complexity. Applications rarely operate independently and software suppliers may themselves depend on cloud infrastructure, SaaS platforms, specialist applications and other technology providers. These fourth-party dependencies can create concentration risks that are difficult for customers to identify. Several seemingly unrelated software suppliers, for example, could depend on the same underlying technology provider. A failure further down that chain could therefore affect multiple critical applications at the same time.
The latest National Risk Register shows some recognition of this problem. It acknowledges that the impact of the supplier insolvency scenario will vary depending on factors including the number of insolvencies occurring simultaneously, with a greater number of failures likely to increase the impact. Understanding these software dependencies therefore needs to form part of recovery planning. Organisations should know what sits behind their critical services, including dependencies beyond suppliers they contract with directly. I would suggest that Government should also be establishing whether existing Service Resolution Plans properly account for these risks.
Financial instability also needs to be considered as part of this process. Current Government guidance includes requirements around assessing and monitoring the financial standing of important suppliers, which can help identify signs of financial stress. However, circumstances can deteriorate quickly and financial information may not always provide sufficient warning before a supplier fails. Recovery arrangements need to account for situations where failure happens unexpectedly and continued access to critical applications is suddenly at risk. There are also areas where Government guidance could provide greater clarity.
Existing procurement guidance recognises circumstances where software escrow can be highly desirable, including where proprietary third-party software is provided by a supplier facing financial stress and a significant risk of failure. However, the treatment of third-party software elsewhere in the guidance can make it difficult to determine when these protections should be considered. There is even an argument that the guidance is contradictory both including and excluding third-party software in various parts.
Commercial off-the-shelf software and SaaS also need clearer consideration too. The value of a software contract does not necessarily reflect the importance of the application it provides. Relatively inexpensive software can still underpin a critical public service, leaving an organisation significantly exposed if access is suddenly lost.
Critical services
Criticality should play a greater role in decisions around software resilience. Organisations need to understand which applications their important services depend upon and ensure the recovery measures reflect the operational consequences of losing them. The Government already has much of the framework required to strengthen this approach. The Sourcing Playbook, Digital, Data and Technology Playbook and Model Services Contract guidance all address elements of supplier and service continuity. Greater clarity around SaaS, COTS software, service-level recovery and the testing of recovery mechanisms would strengthen that existing guidance – and the vital role that escrow plays should be detailed within these documents and not just in the supporting guidance for the model services contract.
Established mechanisms can support this process. Where continued access to proprietary software is critical, software escrow can provide independent access to the software assets required following supplier failure, while verification can establish whether those materials are complete, current and usable. Government and organisations now need to examine Service Resolution Plans at software level, understand dependencies beyond direct suppliers and test whether the technical assets and expertise required for recovery would actually be available following a supplier failure.
The Government’s assumption that reasonable recovery measures are in place needs to be supported by evidence that those measures work. Testing them at service level would provide a much clearer indication of whether the UK’s critical software services are genuinely prepared for the supplier failures the National Risk Register now acknowledges are increasingly likely.
By Wayne Scott, Governance, Risk & Compliance Solutions Lead, Escode.
- Risk & Resilience