\documentclass[conference,10pt,letterpaper]{IEEEtran}
\usepackage{iftex}
\ifPDFTeX
  \usepackage{newtxtext,newtxmath}
\else
  \usepackage{fontspec}
  \setmainfont{Times New Roman}
\fi
\usepackage{cite}
\usepackage{array}
\usepackage{balance}
\usepackage{capt-of}
\usepackage{tabularx}
\usepackage{url}

\title{Four Conditional Governance Controls Relevant to Commissioning and Subsequent Delivery of Business-Critical Custom Software: A Bounded Public-Source Synthesis for SMEs}
\author{
\IEEEauthorblockN{Scaledex Research Labs}
}

\begin{document}
\maketitle

\begin{abstract}
This bounded public-source synthesis examines which governance controls an SME can supportably consider when commissioning business-critical custom software and, for some controls, during delivery and operation. An independent audit retained four directly entailed, conditional controls: formal change control; named security-program accountability with executive oversight; pre-contract, risk-proportionate supplier due diligence; and, for high-risk or business-critical supplier arrangements, contractual definition of scope, responsibilities, assets, security expectations, and incident notification. These are retained controls, not a universally validated minimum for every SME, jurisdiction, sector, delivery model, or criticality tier. The record does not adequately establish customer product-owner authority or timing; engineering assurance, architecture review, and operational handover; universal security, recovery, incident, or ownership blockers; validated delay rules; support readiness; exit adequacy or delivery-model substitutes; source status; or causal consequences from missing customer capabilities. Blocker decisions therefore remain provisional and require organization-specific risk and applicability assessment.
\end{abstract}

\begin{IEEEkeywords}
custom software commissioning, SME governance, supplier due diligence, change control, security accountability
\end{IEEEkeywords}

\section{Introduction}

This synthesis uses business-critical custom software as a working risk category for the commissioning question~\cite{ref-1}.

The question is not whether one readiness checklist applies to every SME. It is which controls are directly supported in the supplied record for a business-critical custom-software supplier arrangement, and which proposed capabilities remain insufficiently supported to operate as general project-blocking criteria~\cite{ref-1,ref-2,ref-3,ref-4}.

\section{Methods}

This paper reports an independent audit of the supplied public-source record; it does not add sources or independently establish the currency, legal status, effective date, or addressee of that record. The audit assessed each material control or recommendation in that bounded record. A proposition was retained only when the audit found the stated control directly entailed by the record without extending it into a universal requirement, a detailed implementation prescription, or a causal claim. Four material controls met that threshold. Propositions that required such an extension, were only partly supported, or were unsupported were excluded from the central result. The audit excluded fourteen recommendations; this synthesis does not reconstruct them as retained controls~\cite{ref-2,ref-3,ref-4,ref-1}.

The coverage assessment also governed interpretation. It could not establish the proposed customer product owner's combined decision rights or lifecycle timing; non-functional requirements, release assurance, maintainability, architecture review, or operational handover; or security, recovery, incident, and ownership controls as universal production go-live blockers. It did not validate thresholds, safeguards, or comparable counterexamples for staged delay or constrained discovery. Support ownership, contact routes, escalation, knowledge transfer, and coverage had weak or null support, with some material represented by supplier marketing. Exit mechanisms and delivery-model-specific alternatives lacked demonstrated adequacy or substitutability. Key guidance had unestablished currency, effective dates, legal status, and addressees, while empirical failure evidence did not demonstrate that missing customer capabilities cause the asserted failures~\cite{ref-1,ref-2,ref-3,ref-4,ref-5,ref-6}.

The analysis preserves source scope rather than treating retained propositions as portable rules. Supplier-governance and contractual-content guidance drawn from Canadian federally regulated financial institutions is used by analogy only; it is not treated as generally binding on SMEs in other sectors. The EEA personal-data observation also remains outside the framework: GDPR applicability depends on establishment or offering of products or services to EEA individuals and processing of personal data, while the supplied record does not determine the detailed controls or contracts required in a particular case~\cite{ref-1,ref-5,ref-4,ref-6}.

\section{Results}

\subsection{Retained Conditional Controls}

The audited record directly supports formal change control, including a contractual change process. In an SME assessment where this control is applicable, the control can include recording proposed changes and their evaluation, approval or rejection, scheduling, and tracking. The record does not prescribe a particular change-board structure or tool~\cite{ref-2,ref-3}.

The audited record directly supports named security-program accountability with executive oversight. Where applicable to the arrangement, the named accountable person need not be a security expert or IT professional. This retained accountability control is not evidence that a particular organisation has demonstrated operational security readiness~\cite{ref-4,ref-1}.

The audited record directly supports risk-proportionate supplier due diligence before entering a supplier arrangement. For an arrangement assessed as requiring it, the review can cover service-failure and disruption risk, the ability to assess supplier controls, financial health, subcontractors and supply-chain complexity, concentration, and the supplier's information-security, privacy, and data practices~\cite{ref-1}.

The audited record directly supports specified contractual content for a high-risk or business-critical supplier arrangement. Subject to jurisdiction, reporting obligations, delivery model, and the organisation's assessment, the agreement can document service scope; roles and responsibilities; subcontractor parameters; performance measures; ownership of and access to relevant assets and documentation; data-security expectations; and notification of service-impacting and cyber incidents~\cite{ref-1}.

\noindent\begin{minipage}{\columnwidth}
\captionof{table}{Table I. Retained conditional governance controls and stated boundaries.~\cite{ref-2,ref-3,ref-4,ref-1}}
\label{tab:result-1}
\centering
\footnotesize
\renewcommand{\arraystretch}{1.08}
\begin{tabularx}{\columnwidth}{|>{\raggedright\arraybackslash}p{0.27\columnwidth}|>{\raggedright\arraybackslash}X|}
\hline
Retained control & Documented consequence, storage implication and timing, and effects not established \\
\hline
Formal change control & \textit{Consequence:} Contractual change process \textit{Storage and timing:} Record, evaluate, approve or reject, schedule, and track changes \textit{Not established:} No prescribed board structure or tool \\
\hline
Security-program accountability & \textit{Consequence:} Security-program governance \textit{Storage and timing:} Named accountable person and executive oversight \textit{Not established:} The accountable person need not be a security or IT specialist \\
\hline
Supplier due diligence & \textit{Consequence:} Before entering an arrangement \textit{Storage and timing:} Assess disruption, controls, financial health, subcontractors, concentration, and data practices \textit{Not established:} Risk-proportionate recommendation; financial-sector guidance is analogical outside its source scope \\
\hline
Contractual allocation & \textit{Consequence:} High-risk or business-critical arrangement \textit{Storage and timing:} Scope, responsibilities, subcontractors, performance, assets, documentation, security, and notification \textit{Not established:} Jurisdiction, reporting duties, and delivery model can require adjustment \\
\hline
\end{tabularx}
\end{minipage}

\subsection{Coverage Limits of the Result}

The result establishes neither a complete production-readiness framework nor universal production go-live blockers. The record leaves unresolved the proposed customer product owner's authority and timing; engineering requirements, including non-functional requirements, release assurance, maintainability, and architecture review; and operational handover. It likewise does not validate security, recovery, incident, or ownership controls as universal blockers, or a specific maintenance-inventory design, patch service level, or end-of-support decision rule as a retained prerequisite~\cite{ref-2,ref-3,ref-4,ref-1,ref-5}.

The record also supplies no validated basis for a threshold-based delay or constrained-discovery rule: staging thresholds, safeguards, and comparable counterexamples remain absent. Support ownership, contact routes, escalation, knowledge transfer, and coverage are partly represented by supplier marketing or remain unsupported. Exit mechanisms and delivery-model-specific alternatives lack evidence of adequacy or substitutability. Key guidance has unresolved currency, effective-date, legal-status, and addressee questions, and empirical failure evidence does not establish the asserted causal consequences of missing customer capabilities~\cite{ref-1,ref-2,ref-3,ref-4,ref-5,ref-6}.

\section{Discussion}

\subsection{Interpretation for Commissioning Decisions}

Taken together, the four retained controls concern governance of change, security accountability, supplier selection, and contractual allocation. They are most defensible as a limited input to an organisation-specific assessment of a business-critical arrangement. They do not establish the proposed customer product owner's combined decision rights or lifecycle timing, nor do they establish non-functional requirements, release assurance, maintainability, architecture review, or operational handover as independently supported minimum capabilities. A decision-maker should therefore distinguish contractual allocation from claims about customer-side engineering readiness or handover capability~\cite{ref-1,ref-2,ref-3,ref-4}.

Security accountability should not be conflated with proof of operational security readiness. The record does not establish security, recovery, incident, or ownership controls as universal production go-live blockers. An application-and-dependency inventory with patching and end-of-support ownership may be operationally relevant, but the retained record does not validate it as a general pre-commissioning minimum and does not prescribe patch service levels or an inventory schema~\cite{ref-4,ref-1,ref-5}.

\subsection{Applicability, Blockers, and Unresolved Coverage}

The supplier due-diligence and contractual recommendations derive in part from Canadian financial-sector guidance. Their transfer to another SME, jurisdiction, sector, or delivery model requires separate assessment of criticality, legal applicability, supplier dependence, and risk. Where EEA-related personal-data processing is relevant, the supplied record supports only a conditional observation about GDPR applicability; it does not resolve jurisdiction-specific compliance or identify the detailed contractual controls required. Unestablished source currency, effective dates, legal status, and addressees for key guidance further limit any direct transfer of these propositions~\cite{ref-1,ref-6}.

A proposal to delay or constrain a project because a retained control is absent is an analytical recommendation, not a retained control or a validated decision rule. Its use requires an organisation-specific risk and applicability assessment. The record lacks validated staging thresholds, safeguards, and comparable counterexamples for constrained discovery or delay decisions, and it does not establish causal consequences from missing customer capabilities~\cite{ref-2,ref-3,ref-4,ref-1}.

Important coverage gaps remain for decision-making beyond the four retained controls. Support ownership, contact routes, escalation, knowledge transfer, and coverage are partly represented by supplier marketing or remain unsupported, so the record cannot establish support readiness. Exit mechanisms and delivery-model-specific alternatives lack evidence demonstrating adequacy or substitutability. Together with inadequate independent support for engineering assurance and operational handover, the absence of demonstrated causal failure consequences prevents the synthesis from functioning as a comprehensive readiness checklist or from treating these gaps as universal blockers~\cite{ref-1,ref-5,ref-4,ref-6}.

\section{Conclusion}

For an SME commissioning business-critical custom software, the bounded result is four directly supported conditional controls: formal change control; named security-program accountability with executive oversight; risk-proportionate pre-contract supplier due diligence; and, for high-risk or business-critical supplier arrangements, contractual definition of service scope, roles and responsibilities, subcontractor parameters, performance measures, relevant assets and documentation, data-security expectations, and service-impacting and cyber-incident notification. Their application to a particular SME remains an analytical, risk- and applicability-dependent decision~\cite{ref-2,ref-3,ref-4,ref-1}.

This result does not support a universal SME minimum-capability model. Additional requirements, including any decision to delay commissioning, require justification through the organisation's criticality assessment, legal context, supplier model, and risk assessment. The unresolved gaps concerning product ownership, engineering and handover, operational controls, delay rules, support, exit, source status, and causal evidence should remain visible in that decision rather than being converted into asserted universal blockers~\cite{ref-1,ref-2,ref-3,ref-4,ref-6}.

\balance

\section*{AI Assistance Disclosure}
This report is an AI-assisted synthesis of retained public sources; it does not report original interviews or experiments. It presents a bounded public-source synthesis, not a universally validated minimum-capability model.

\begin{thebibliography}{00}
\bibitem{ref-1} www.osfi-bsif.gc.ca, ``Third-Party Risk Management Guideline,'' \emph{www.osfi-bsif.gc.ca}. Accessed: Sep. 1, 2026. [Online]. Available: \url{https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/third-party-risk-management-guideline}
\bibitem{ref-2} www.justice.gov, ``Appendix A,'' \emph{www.justice.gov}. Accessed: Sep. 1, 2026. [Online]. Available: \url{https://www.justice.gov/archive/jmd/irm/lifecycle/appendixa.htm}
\bibitem{ref-3} www.wrightcountymn.gov, ``Oracle Cloud Implementation Services Statement of Work,'' \emph{www.wrightcountymn.gov}. Accessed: Sep. 1, 2026. [Online]. Available: \url{https://www.wrightcountymn.gov/AgendaCenter/ViewFile/Item/7207?fileID=14830}
\bibitem{ref-4} www.cisa.gov, ``Cyber Guidance for Small Businesses,'' \emph{www.cisa.gov}. Accessed: Sep. 1, 2026. [Online]. Available: \url{https://www.cisa.gov/cyber-guidance-small-businesses}
\bibitem{ref-5} www.ncsc.govt.nz, ``Critical Controls: Summary,'' \emph{www.ncsc.govt.nz}. Accessed: Sep. 1, 2026. [Online]. Available: \url{https://www.ncsc.govt.nz/protect-your-organisation/summary/}
\bibitem{ref-6} www.edpb.europa.eu, ``FAQ | Data protection guide for small business,'' \emph{www.edpb.europa.eu}. Accessed: Sep. 1, 2026. [Online]. Available: \url{https://www.edpb.europa.eu/sme/find-practical-info/faq_da?page=1}
\end{thebibliography}

\end{document}
