Toggle menu

Software Security Code of Practice

Theme 4: Communication with customers

Principle 4.1 Provide information to the customer specifying the level of support and maintenance provided for the software being sold

ReferencePrinciples/ClaimsEvidence
Claim 4.1.1'End of support' dates are published for all software components.Yes. Historically, when software has been deemed end of life/or end of support, considerable notice was given. As an example when a previous service of the platform, GOSS iCM Render was given over a year of notice of being unsupported and support was given to customers to move from this service.
Claim 4.1.2A policy on frequency of updates and the process for applying them is published.The Hosting Service Manual is published online detailing all scheduled maintenance and updates. It also includes Release Management and Change Control processes.
Claim 4.1.3User documentation describes how to correctly and securely apply updates and use software.n/a The service is delivered as a fully managed SaaS platform and software updates are deployed by GOSS. Client are not required to install or apply updates directly.

Principle 4.2 Provide at least 1 year's notice to customers of when the software will no longer be supported or maintained by the vendor

ReferencePrinciples/ClaimsEvidence
Claim 4.2.1Customers are given at least 1 year's notice of when software will no longer be supported.Yes GOSS iCM Render example evidence in Claim 4.1.1

Principle 4.3 Make information available to customers about notable incidents that may cause significant impact to customer organisations

ReferencePrinciples/ClaimsEvidence
Claim 4.3.1Customers are informed of relevant incidents in a timely mannerWhere an incident is identified as having a significant impact on a client's organisation, a client incident ticket is raised and managed in accordance with the Incident Management process
Last modified on 27 October 2026