[INDIA] RBI, SEBI and IRDAI · Source-code escrow and continuity obligations for critical applications[EU DORA] ICT third-party risk testing required · In force Jan 2025[PRA] SS2/21 UK · Vendor recovery evidence required[MAS] Singapore TRM · Independent vendor recoverability expected[APRA] CPS 230 Australia · Third-party continuity obligations in force[FFIEC] United States · Source-code access and software escrow addressed in third-party contracts[ENTERPRISE] Mission-critical software procurement increasingly requires continuity evidence before contract
[INDIA] RBI, SEBI and IRDAI · Source-code escrow and continuity obligations for critical applications[EU DORA] ICT third-party risk testing required · In force Jan 2025[PRA] SS2/21 UK · Vendor recovery evidence required[MAS] Singapore TRM · Independent vendor recoverability expected[APRA] CPS 230 Australia · Third-party continuity obligations in force[FFIEC] United States · Source-code access and software escrow addressed in third-party contracts[ENTERPRISE] Mission-critical software procurement increasingly requires continuity evidence before contract
All regulations

EUROPEAN UNION · DIRECTIVE (EU) 2022/2555

EU NIS2Network & Information Security Directive 2

NIS2 raises the common level of cybersecurity across essential and important entities, with explicit duties around supply-chain security and the continuity of essential services during incidents. This guide explains the requirement, scope, timeline and evidence mapping for software escrow and Software Recoverability.

REGULATORY EVIDENCE MAP

EU NIS2

EUROPEAN UNION · DIRECTIVE (EU) 2022/2555
01

PERIMETER

European Union

02

REQUIREMENT

Risk-management measures for the security of network and information systems

03

CASTLER EVIDENCE

Third-party and vendor software is independently rebuilt and verified, closing a key supply-chain blind spot

OUTPUT

Signed Proof of Recovery

ARTICLE ANATOMY

Network & Information Security Directive 2

EUROPEAN UNION · DIRECTIVE (EU) 2022/2555

Who it applies to

  • Entities and teams responsible for risk-management measures for the security of network and information systems
  • Entities and teams responsible for supply-chain and third-party software security across the vendor relationship
  • Entities and teams responsible for business continuity and crisis management for essential services
  • Entities and teams responsible for management-body accountability for cyber-resilience measures

Confirm the current implementation status and any jurisdiction-specific deadline against the official text and supervisory guidance applicable to your entity.

Requirement

Risk-management measures for the security of network and information systems

Castler artefact

Third-party and vendor software is independently rebuilt and verified, closing a key supply-chain blind spot

Requirement

Supply-chain and third-party software security across the vendor relationship

Castler artefact

A signed Proof of Recovery shows the system can be restored without the original vendor in the room

Requirement

Business continuity and crisis management for essential services

Castler artefact

Recoverability evidence reinforces continuity planning for essential services

Requirement

Management-body accountability for cyber-resilience measures

Castler artefact

Board-examinable seals give the management body defensible, repeatable accountability

THE GLOBAL REGULATORY MANDATE

The regulator stopped asking “Do you have escrow?” It now asks “Can you prove recovery?”

Across financial regulation, cyber-resilience rules and global assurance standards, the direction is converging: critical third-party software must remain current, testable and recoverable when its provider fails.

17

MANDATES

9

JURISDICTIONS

European UnionUnited KingdomUnited StatesAustraliaSingaporeSaudi ArabiaUnited Arab EmiratesGlobal StandardsIndia
Explore every mandate and evidence map

1 · WHAT THE REGULATION IS

What is EU NIS2?

Network & Information Security Directive 2 is the governing framework or standard represented on this page.

NIS2 raises the common level of cybersecurity across essential and important entities, with explicit duties around supply-chain security and the continuity of essential services during incidents. For a CIO, CISO or compliance officer, the practical issue is whether a critical third-party application can remain available when the provider fails, exits, is acquired or can no longer support the product.

Software escrow addresses custody: who holds the source code, build materials and documentation. Software Recoverability addresses the next question: whether those materials have been independently rebuilt, deployed and tested. The distinction matters because an agreement and a deposit do not prove that recovery can be completed within the institution’s operational tolerance.

Castler therefore treats the requirement as part of vendor onboarding. The agreement and first deposit are established when the relationship begins, every release is captured, and the verification evidence is renewed before an auditor, insurer or supervisor asks for it.

2 · EXACT REQUIREMENT

Network & Information Security Directive 2

In summary

Risk-management measures for the security of network and information systems; Supply-chain and third-party software security across the vendor relationship; Business continuity and crisis management for essential services; Management-body accountability for cyber-resilience measures

Reference: Network & Information Security Directive 2. For legal interpretation and exact operative wording, use the current official text and advice applicable to your supervisory perimeter.

In practical terms, compliance requires more than a clause in the vendor contract. The institution must identify which applications are critical, establish custody or source-code access, ensure the deposited materials remain current, document release conditions and maintain evidence that continuity or exit can be executed.

Where the framework requires tested recovery, resilience or credible exit, a stored deposit is only the starting control. Independent build evidence, deployment instructions, architecture replication and a signed engineer review show that the recovery path has been exercised rather than assumed.

3 · Who it applies to

Entities and teams responsible for risk-management measures for the security of network and information systems

Entities and teams responsible for supply-chain and third-party software security across the vendor relationship

Entities and teams responsible for business continuity and crisis management for essential services

Entities and teams responsible for management-body accountability for cyber-resilience measures

The accountable group normally includes technology, information security, outsourcing, procurement, compliance, business continuity and the business owner of the supported service. Scope should be based on criticality, not only contract value.

4 · Compliance timeline

EUROPEAN UNION · DIRECTIVE (EU) 2022/2555

Confirm the current implementation status and any jurisdiction-specific deadline against the official text and supervisory guidance applicable to your entity.

Institutions should work backwards from the operative date. Vendor identification, agreement execution, repository integration, initial deposit, reconciliation and first verification all require lead time. Onboarding-first implementation avoids a deadline-driven retrofit.

5 · CONSEQUENCES

What happens when the evidence is missing?

Failure to maintain credible third-party resilience can lead to audit findings, remediation programmes, increased supervisory scrutiny, reputational damage and operational loss during a provider disruption.

The operational consequence can be more severe than the supervisory consequence. If a critical provider fails and the deposited software cannot be built or deployed, the institution may breach customer commitments, impact tolerances, market obligations and board-approved continuity objectives while the technical team reconstructs undocumented knowledge under incident conditions.

A current custody record and signed Proof of Recovery reduce that uncertainty. They do not replace legal analysis, incident planning or the institution’s own controls; they create tested technical evidence that those controls rely on.

6 · CASTLER EVIDENCE MAPPING

How Castler maps to EU NIS2.

The mapping is specific: each obligation is paired with the Castler artefact or operating control that provides relevant evidence. It is not a claim that software alone guarantees compliance.

Regulatory requirementCastler evidence
Risk-management measures for the security of network and information systemsThird-party and vendor software is independently rebuilt and verified, closing a key supply-chain blind spot
Supply-chain and third-party software security across the vendor relationshipA signed Proof of Recovery shows the system can be restored without the original vendor in the room
Business continuity and crisis management for essential servicesRecoverability evidence reinforces continuity planning for essential services
Management-body accountability for cyber-resilience measuresBoard-examinable seals give the management body defensible, repeatable accountability

Cloud Custody

Establish the software escrow agreement, current deposit, release history and audit trail required as the custody foundation.

Explore custody →

Software Recoverability

Add independent rebuild, deployment, replication, confidence scoring and an engineer-sealed Proof of Recovery.

Explore Proof of Recovery →

7 · FREQUENTLY ASKED QUESTIONS

EU NIS2 questions from compliance and technology teams.

Does having a software escrow agreement satisfy the requirement?

An agreement can satisfy the contractual custody element, but EU NIS2 also expects the institution to manage continuity, third-party risk or recovery evidence. The exact answer depends on the clause and supervisory perimeter.

How current must the source-code deposit be?

The deposit should track the production release. Automated repository capture, version history and release identifiers make it possible to show that updates and fixes are included rather than relying on the original filing.

Does the software vendor need to participate in every verification?

The vendor participates in onboarding, deposit setup and structured reconciliation where documentation is missing. Verification is then designed to run independently so the vendor does not need to be present every time.

What evidence should be presented to an auditor or supervisor?

Present the executed escrow arrangement, deposit and release history, build report, deployment runbook, replication report, SBOM, confidence score, exception record and signed Proof of Recovery for the release in scope.

Can an institution begin with custody and add verification later?

Yes. Cloud Custody establishes the current deposit and agreement. The same record can be upgraded to Standard or Premium Software Recoverability without creating a new custody foundation.

How often should recoverability be re-tested?

Re-test when the vendor releases a material version and according to the institution’s criticality, regulatory and board-approved assurance cycle. Per-release verification avoids stale annual evidence.

8 · RELATED REGULATIONS

Continue the third-party resilience mapping

European Union

EU DORA

DORA requires financial entities to keep ICT third-party risk under control across the full lifecycle of a contract — including a documented exit strategy and assurance that a critical or important function can continue if a provider fails (Article 28).

Read the mapping

European Union

EU CRA

The Cyber Resilience Act sets cybersecurity requirements for products with digital elements across their lifecycle — secure development, vulnerability handling, and support obligations for manufacturers placing software on the EU market.

Read the mapping

India

RBI §12(f)

RBI's directions on outsourcing of IT services require regulated entities to maintain robust exit strategies and business-continuity arrangements so critical operations survive a service provider's exit or failure.

Read the mapping

This guide is for regulatory orientation and does not constitute legal advice. Verify obligations against current official texts and professional advice for your entity.

EU NIS2

Make the recovery claim examinable

Bring your EU NIS2 perimeter. We’ll map the critical systems, current custody and Proof of Recovery evidence required for a defensible procedure.

Book a 15-min briefing
ISO 27001SOC 2 Type IIPCI DSS

No spam · Reply within one business day