# What should we ask a SaaS vendor about security before signing?

Ask questions whose answers you can check and that matter if something goes wrong. Evidence: which independent reports or certificates cover the service you are buying, such as a SOC 2 Type II report or ISO/IEC 27001 certificate, with scope and date, and whether you may read them. Data: where it is stored and processed, which sub-processors are involved, whether it is used to train models, how long it is kept and how you get it back in a usable format when you leave. Access: single sign-on, MFA enforcement, role-based permissions, and audit logs you can export. Incidents: how fast they notify you, through which channel, and what support they give for your own reporting duties under GDPR or NIS2. Resilience: backups, restore objectives and how they protect against an admin account being misused. Vulnerabilities: how they handle reports and how fast they patch. Write the key answers into the contract or the data-processing agreement, not only a questionnaire. A smaller vendor with clear, honest answers can be safer than a large one with vague ones.

FAQ: [Cloud and SaaS security](https://netsenx.com/en/faq/cloud) · https://netsenx.com/en/faq/what-should-we-ask-a-saas-vendor-about-security

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/eu-data-residency

## Related questions

- [Who is responsible when our SaaS provider is breached?](https://netsenx.com/en/faq/who-is-responsible-when-a-saas-provider-is-breached)
- [Does NIS2 make us responsible for our cloud providers' security?](https://netsenx.com/en/faq/does-nis2-make-us-responsible-for-our-cloud-providers)
- [What do we do if a cloud or SaaS account is compromised?](https://netsenx.com/en/faq/what-to-do-if-a-cloud-account-is-compromised)
- [What is the shared responsibility model in the cloud?](https://netsenx.com/en/faq/what-is-the-shared-responsibility-model-in-the-cloud)
- [What is the difference between IaaS, PaaS and SaaS?](https://netsenx.com/en/faq/what-is-the-difference-between-iaas-paas-and-saas)