Marks & Spencer

Use case

Business Continuity, Supply Chain Resilience, Risk Management

Industry

Retail

Team size

70,000–75,000 employees

Services

Escrow as a Service (EaaS),
Replicate+Agreement,
Verification Services

Challenge

When British multinational retailer, M&S, began working with a new software vendor, they sought reassurance and peace of mind to help them balance risk and enable innovation with confidence. Expanding an organization’s supply chain and relying on third-party, cloud-hosted software comes with inherent risks, particularly when partnering with a vendor that is relatively newly established.

While the innovative and agile nature of smaller software vendors may be appealing, it also poses a risk due to the lack of a track record or a long list of reference clients for due diligence. Therefore, M&S sought reassurance and peace of mind to help them mitigate risk and foster innovation confidently in their collaboration with the new vendor.

“Technology and innovation is central to our success and transformation here at M&S. Working with niche and newly formed software vendors helps us to remain agile and retain a competitive advantage, so it is vital that we build in supply chain assurance from the outset and ensure we aren’t negatively impacted by circumstances outside of our control such as vendor downtime or failure.”

– Rob Barnes, CTO, M&S Tech

Solution

Escode’s software resilience solutions simplify business continuity to ensure applications, source code and data are safe, secure and always available in the event of vendor failure.

Collaborating closely, M&S and Escode crafted an operational resilience plan for the new, mission-critical application. This plan ensured that M&S had access to the necessary materials to replicate their cloud-hosted production environment, production data, and deploy the application directly from the source code. This comprehensive approach provided M&S with peace of mind regarding the long-term availability and accessibility of the application.

Escrow agreements ensure that software source code is held securely and independently with both the end user and software supplier’s agreement, ensuring that the material can be accessed and released if needed.

In this particular case, the application in question was hosted on a multi-tenanted cloud environment, via a market leading infrastructure as a service (IaaS) provider, with the vendor owning this subscription.

Following technical scoping with both parties, Escode, part of NCC Group recommended an Escrow as a Service (EaaS) Replicate+ agreement to give M&S the ability to access its production data and source code and also re-create its cloud hosted production environment.

In addition, M&S required an extra layer of resilience so Escode carried out a Replicate+ Verification, ensuring that if disruption should occur and the source code needs to be released, it can be used to rebuild the platform as M&S would have the knowledge and guidance to manage and maintain or indeed recreate the application from the material deposited in Escrow.

In a collaborative effort involving M&S and the software vendor, Escode remotely oversaw the complete creation of the cloud infrastructure necessary to support the application. During this process, Escode meticulously documented the tasks, information, and knowledge essential for M&S to autonomously operate the live production environment, even without dependency on their software vendor.

"Our range of software escrow solutions provide customers with the robust foundations and security to adopt, innovate and manage new and existing technology with confidence. Working closely together we enable them to prepare for anything and protect operations by minimising potential downtime should their vendor become unable to continue to support them.”

– Adrian Ah-Chin-Kow, Global Commercial Director at Escode

Results

With the implementation of a robust business continuity programme, M&S was able to gain assurance that the software would be available in the event of vendor failure and also that it had confidence on what to do if this event occurred.

Rob Barnes, CTO, M&S Tech said: “Technology and innovation is central to our success and transformation here at M&S. Working with niche and newly formed software vendors helps us to remain agile and retain a competitive advantage, so it is vital that we build in supply chain assurance from the outset and ensure we aren’t negatively impacted by circumstances outside of our control such as vendor downtime or failure.”

Adrian Ah-Chin-Kow, Global Commercial Director at Escode: “Our range of software escrow solutions provide customers with the robust foundations and security to adopt, innovate and manage new and existing technology with confidence.

Working closely together we enable them to prepare for anything and protect operations by minimising potential downtime should their vendor become unable to continue to support them.”