How many open source components are present in the OLM Eclipse system? I won’t ask you to name them as this might be considered commercially sensitive by OLM, though I would expect the Council to know what these are.
We do not hold this information. The system is provided through a contractual arrangement and is hosted and managed by the provider, we would not expect or need to hold the information.
Does the Council know the latest security patch release number for each of these components?
No, we do not hold this information. The system is provided through a contractual arrangement and is hosted and managed by the provider, we would not expect or need to hold the information.
Does the Council have an agreed process in place with OLM to manage these specific security patches? If the solution is hosted by OLM then this might be relatively invisible to the Council, but PSN requires that the Council has a monitoring process and can actively verify that it is not running software outside the security patch window
Yes, we monitor hosted and managed services through contractual and Service Agreements. The responsibility to ensure that system components, open-source or otherwise, are at the latest security patch, is that of the provider and is clearly documented and agreed.