What should we ask a SaaS vendor about security before signing?
Ask questions whose answers you can check and that matter if something goes wrong. Evidence: which independent reports or certificates cover the service you are buying, such as a SOCSOC: security operations centre. A team, often working around the clock, whose job is to watch for and respond to attacks. 2 Type II report or ISO/IEC 27001 certificate, with scope and date, and whether you may read them. Data: where it is stored and processed, which sub-processors are involved, whether it is used to train models, how long it is kept and how you get it back in a usable format when you leave. Access: single sign-on, MFA enforcement, role-based permissions, and audit logs you can export. Incidents: how fast they notify you, through which channel, and what support they give for your own reporting duties under GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). or NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.. Resilience: backups, restore objectives and how they protect against an admin account being misused. Vulnerabilities: how they handle reports and how fast they patch. Write the key answers into the contract or the data-processing agreement, not only a questionnaire. A smaller vendor with clear, honest answers can be safer than a large one with vague ones.
Read next
Related questions
Terms used here
- SOC (security operations centre)
- A team, often working around the clock, whose job is to watch for and respond to attacks.
- GDPR (General Data Protection Regulation)
- The EU data protection law (Regulation (EU) 2016/679).
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.