Enterprise Security Review for SaaS Vendors Template

Enterprise procurement teams send security questionnaires to SaaS vendors before signing contracts. These questionnaires vary in length and format, but they cover the same core categories: how customer data is protected, who can access it, what certifications are in place, how incidents are handled, and what the vendor's own supply chain risk looks like.

This template serves two purposes: for SaaS vendors, it is a preparation checklist — review each item and document your current status before a prospect sends their questionnaire. For procurement teams evaluating SaaS vendors, it is a structured review framework covering the categories that matter for enterprise risk management.

🔒 Category 1: Data Security

Data security controls cover how customer data is stored, transmitted, and protected against unauthorized access or exfiltration.

Control	Priority	What to Verify
Encryption in transit	Required	TLS 1.2 or higher on all endpoints; HTTPS enforced; no plaintext API endpoints
Encryption at rest	Required	Database and file storage encrypted at rest; cloud provider native encryption or customer-managed keys
Application-level encryption for sensitive fields	Important	PII, financial, and health data fields encrypted at application layer, not just storage layer
Data classification policy	Important	Data types categorized by sensitivity; handling procedures defined for each category
Data retention and deletion	Required	Documented retention periods; ability to delete customer data on request; deletion verified
Data residency controls	Important	Customer data stored in documented geographic regions; EU residency available if required
Backup security	Important	Backups encrypted; backup access requires same controls as production; restoration tested
Secure data disposal	Optional	Hardware and media disposal process documented; certificates of destruction for physical media

Category 2: Access Control

Access control covers who can access systems, data, and customer information — and how those permissions are managed, audited, and revoked.

Control	Priority	What to Verify
Role-based access control (RBAC)	Required	Access permissions defined by role; users assigned minimum permissions needed
Multi-factor authentication	Required	MFA required for all production system access; MFA required for admin panel access
SSO / SAML support	Required	SAML 2.0 or OIDC supported; integration with Okta, Azure AD, and Google Workspace documented
SCIM provisioning	Important	Automated user provisioning and deprovisioning via SCIM 2.0; deprovisioning tested
Privileged access management	Required	Production access requires explicit approval; access logged and reviewed; just-in-time access preferred
Service account management	Important	Service accounts have documented owners; credentials rotated on schedule; unused accounts deactivated
Offboarding process	Required	Access revoked within 24 hours of employee departure; checklist documented; access audit follows
Customer data access by vendor staff	Required	Vendor employee access to customer data requires approval; all access logged; customer notification policy

Category 3: Compliance and Certifications

Compliance controls establish that the vendor operates under a defined, audited security framework appropriate for enterprise data handling.

Control	Priority	What to Verify
SOC 2 Type II report	Required	Current report available; report scope covers relevant trust service criteria; NDA sharing process defined
GDPR compliance	Required for EU data	DPA available; data processing activities documented; privacy policy current; breach notification process
HIPAA compliance	Required for health data	BAA available; PHI handling documented; access controls meet HIPAA minimum
ISO 27001 certification	Optional	Certificate current; scope covers relevant systems; surveillance audit schedule
Penetration testing	Important	Annual third-party pen test; remediation report available; critical findings addressed before sharing
Vulnerability management	Required	Regular vulnerability scans; dependency scanning in CI/CD; CVE response SLA documented
Security policies documentation	Important	Information security policy, acceptable use policy, and incident response policy available on request

Category 4: Incident Response

Incident response controls define how the vendor detects, contains, and communicates security incidents — and what obligations they have to customers when incidents occur.

Control	Priority	What to Verify
Incident response plan	Required	Documented IRP covering detection, containment, eradication, and recovery; tested annually
Customer breach notification SLA	Required	Notification timeline defined (typically 72 hours for GDPR); escalation path and contact documented
Security incident log	Important	History of material security incidents available; summary of incidents in SOC 2 report or on request
Security monitoring and alerting	Required	24/7 alerting on anomalous access and error conditions; on-call rotation defined; escalation process
Forensic capability	Important	Logs retained for minimum 12 months; log integrity protected; forensic investigation capability available
Tabletop exercises	Optional	Annual incident simulation; results documented; findings incorporated into IRP updates

Category 5: Vendor and Supply Chain Risk

Enterprise customers are increasingly responsible for the security posture of the vendors their vendors use. This category addresses sub-processor risk and third-party integration security.

Control	Priority	What to Verify
Sub-processor list	Required	Current list of third-party services with access to customer data; change notification process
Sub-processor security review	Important	Critical sub-processors reviewed for security posture; SOC 2 or equivalent required for data processors
Data Processing Agreements with sub-processors	Required for GDPR	DPAs in place with all sub-processors handling EU personal data
Software supply chain security	Important	Dependency scanning in CI/CD; SBOM available for critical components; known-vulnerable packages blocked
Source code security	Important	Code review required for all changes; SAST/DAST tooling in pipeline; secrets scanning in CI
Infrastructure-as-code security	Optional	IaC templates scanned for misconfigurations; change management process for infrastructure changes