S 2.81 Preselection of a standard software product
Initiation responsibility: Purchasing Department
Implementation responsibility: Purchasing Department, Head of IT, Head of Specialised Department
The preselection of a standard software product is based on the requirements catalogue drawn up by the Specialised Department and the IT Area. First, the authority responsible for preselection should conduct a market analysis and draw up a tabular market overview based on the requirements catalogue. This table should comment on the products in question with regard to the points stipulated in the requirements catalogue.
The market overview should be drawn up by the IT area. It can be compiled using product descriptions, statements by manufacturers, journals or information from retailers. Alternatively, an invitation to tender is possible and occasionally required. The requirements catalogue should be the basis of such an invitation to tender so that a market overview can be drawn up using the offers received.
Afterwards, the products compiled in the market overview must be assessed with regard to the specifications of the requirements catalogue. In this respect, the assessment scale developed in S 2.80 Drawing up a requirements catalogue for standard software can be used. Based on the present information, it is determined which of the required features of the product are available. If the product is not equipped with the required features, it is rejected. Assessing the significance of the individual features of each product, a total can be determined. Based on these totals, a list of the most favourable products can be created for the preselected products.
Example:
The features for a compression program as required and assessed in the requirements catalogue are weighted as follows:
| Property | Necessary/Desirable | Significance | Product 1 | Product 2 | Product 3 | Product 4 |
|---|---|---|---|---|---|---|
| Correct compression and decompression | N | 10 | Y | Y | Y | Y |
| Detection of bit errors in a compressed file | N | 10 | Y | Y | K.O. | Y |
| Deletion of files only after successful compression | N | 10 | Y | Y | Y | Y |
| DOS PC, 80486, 8 MB | N | 10 | Y | Y | Y | Y |
| Windows-compatible | D | 2 | N | Y | Y | Y |
| Throughput of over 1 MB/s at 50 MHz | D | 4 | Y | Y | Y | N |
| Compression rate over 40% for text files of the program XYZ | D | 4 | Y | Y | N | N |
| Online Help system function | D | 3 | N | N | N | Y |
| Maximum cost of 50.00 euro per licence | N | 10 | Y | Y | Y | Y |
| Password protection for compressed files (high mechanism strength) | D | 2 | Y | Y | N | Y |
| Assessment | 65 (= max) | 60 | 62 | K.O. | 57 |
As a result, Product 3 is excluded as a necessary feature is not available. The most favourable is Product 2, followed by Product 1 and 4.
This list of the most favourable products and the market overview should then be submitted to the Purchasing Department so that it can check how far the products listed comply with internal and legal regulations. The Purchasing Department must also ensure that the other authorities whose stipulations must be adhered to, such as the Data Privacy Officer, the IT Security Officer or the Personnel / Supervisory Board, are involved in good time.
It must be decided how many and which potential products on the list of the most favourable products should be tested. For obvious reasons, the first two or three candidates should be selected and tested as to whether they actually fulfil the most important criteria of the requirements catalogue. This is particularly important with regard to the necessary requirements. Here, test licences should be purchased and tests should be carried out as described in S 2.82 Developing a test plan for standard software and S 2.83 Testing standard software.
In addition to the criteria of the requirements catalogue, the decision can be based on the following points:
- References
If the manufacturers or vendors can provide reference installations for their products, the experience of the users can be included in the assessment of the product.
In the event that external test results or quality assurances are available for the software product (e.g. test results in journals, conformity tests according to accepted proprietary standards, tests and certificates according to relevant standards and norms, such as ISO 12119), these results should be taken into consideration during the preselection process. - Product popularity
In the event that the product is very popular, the individual user has little or no influence on the product manufacturer as far as error correction or the implementation of certain functions is concerned. The user can, however, assume that the product will be developed further. There are often external tests commissioned by the manufacturer or carried out by journals. For popular products, vulnerabilities are generally more widely known which means that the user can assume that most vulnerabilities are already known and that the knowledge concerning vulnerabilities and remedies is distributed quickly, i.e. he/she can obtain help.
In case of a low degree of popularity, a user can have more influence on the manufacturer. External tests are generally not available as these are too expensive and time-consuming for products of small manufacturers. Products with a low degree of popularity do not usually contain more errors than those which are very popular. The disadvantage is that these errors are often not detected as quickly, thus not allowing swift elimination. If security gaps are involved, however, these are probably not known to potential attackers or they are not worthwhile targets. - Cost-effectiveness / costs for purchase, operation, maintenance and training
Before the decision to purchase a certain product is taken, the following question should always be asked: Are the costs for the product proportionate to its benefits? In addition to the initial purchase costs, the costs for operation, maintenance and training should be considered. It should be clarified, for example, whether the existing hardware platform has to be updated or whether training is needed for installation and operation.
When the decision has been taken to purchase a product, it should obviously be purchased from the least expensive provider. This may have become clear from the market research.
Review questions:
- Is a market overview drawn up to preselect standard software based on the requirements catalogue?
- Is the time and expense of training users in handling new standard software products included in the selection?