FOI Release: Software asset/contract registers and spend

1. Software asset and contract registers

If Registers of Scotland maintains any of the following, please provide the current version:

• (a) a software asset register or application register

• (b) an ICT or digital contract register

Please supply these in machine-readable form (Excel) rather than PDF if possible. If any field in a register is exempt, please provide the register with that field removed rather than withholding it in full.

2. Expenditure on named suppliers

For the financial year 2025/26, please state the total expenditure on products and services originating from each of the following:

• (a) Microsoft
• (b) Oracle
• (c) Amazon Web Services

Please include spend made through a reseller, licensing solution provider, systems integrator, managed service provider or public sector framework, as well as any spend made directly with the supplier.

3. Licence and subscription volumes

As at 31 March 2026, please state the number of licences or subscriptions held for each of the following categories:

• Microsoft Windows (desktop and server operating systems)
• Microsoft 365 / Office
• All other Microsoft products (including Dynamics, SQL Server and Azure subscriptions)
• Oracle database products
• Oracle application products
• All other Oracle products

If licences are held under an enterprise agreement or similar arrangement that does not record a per-user count, please say so and give the metric that is used instead.

4. Total software expenditure

For the financial year 2025/26:

• (a) total expenditure on all software licences, subscriptions and cloud services
• (b) a list of every software or cloud supplier on which Registers of Scotland spent more than £50,000, with the amount spent on each.

Response:

Please see the enclosed ‘CW-2026-599 Information Combined’ which contains the information held by RoS falling within the scope of your request.

For question 1, we have provided sanitised versions of:

• RoS's software/application register; and
• RoS's ICT/digital contract register

Where limited information within these registers has been withheld or generalised under FOISA, we have retained the remainder of the register information rather than withholding the relevant register in full.

The workbook also provides:

• 2025/26 expenditure relating to Microsoft, Oracle and Amazon Web Services;
• the requested Microsoft and Oracle licence and subscription information; and
• total 2025/26 expenditure on software licences, subscriptions and cloud services, including information on higher-value suppliers.

RoS does not hold the supplier-level expenditure breakdown requested at question 4(b) in that form. In accordance with section 17(1) of FOISA, we therefore give notice that this information is not held.

To assist, we have therefore provided the closest relevant recorded information we hold: details of relevant IT/digital contracts with annual costs exceeding £50,000 that were active during 2025 to 2026. These figures represent annual contract costs rather than actual expenditure during the financial year and may include more than one contract for an individual supplier.

Please note we also publish a Contracts Register on Public Contracts Scotland.

Information withheld

Section 38(1)(b): third party personal data

The Product Owner field, which contains individual staff names, has been removed from the enclosed software asset register under section 38(1)(b) of FOISA. Disclosure would contravene the lawfulness, fairness and transparency principle in Article 5(1)(a) of the UK GDPR. Section 38(1)(b) is an absolute exemption and is not subject to the public interest test.

Section 30(c): prejudice to the effective conduct of public affairs

Certain technical information within the ICT contract register and software/application register has been withheld under section 30(c) of FOISA.

The withheld information identifies specific technologies used to operate, administer and protect RoS systems, including security, authentication, remote access, infrastructure, database, backup and internal business systems. Where appropriate, this information has been replaced with broader functional categories rather than withheld entirely.

Disclosure of the detailed information, particularly when considered collectively, would provide greater insight into RoS's technical and security environment and could assist in identifying potential targets or vulnerabilities. We consider there is a real and significant risk that disclosure would increase the likelihood of cyberattack or disruption to systems supporting RoS's statutory functions and would therefore be likely to prejudice substantially the effective conduct of public affairs.

Public interest test

We recognise the public interest in transparency regarding RoS's use of technology and public resources. We have therefore disclosed information wherever this can be done without creating the identified risk, including through consolidation and generalisation rather than wholesale withholding.

However, we consider that the public interest in disclosure of the limited technical detail withheld is outweighed by the public interest in protecting the security and resilience of RoS's systems and the continued delivery of its statutory functions. On balance, the public interest therefore favours maintaining the exemption.

Find out more