What requirements have you used to evaluate and select a SAAS SPM tool?

Applications & PlatformsSecurity Strategy & Roadmap
230 viewscircle icon2 Comments
Sort by:
Information Security Director in Banking17 hours ago

When evaluating a SaaS SPM (SaaS Security Posture Management) tool, recommend start by mapping your current SaaS inventory and identifying upcoming procurements—because you can’t protect what you don’t know you have. From there, define clear business and PoC requirements to test only a few market leaders in a realistic environment.

Not every product marketed online is truly SaaS, and not every SaaS is mature enough for SSPM integration. Prioritize SSPM vendors with custom connector capabilities or a solid integration pipeline on their roadmap—future-proofing is critical. As some of your critical SaaS vendors might not be a major industry leader like ServiceNow or Salesforce.

Strategically, it pays to:

- Align evaluation with procurement and vendor risk processes so SSPM isn’t bolted on later.
- Treat SaaS onboarding as part of your attack surface reduction strategy, not just compliance.
- Use SSPM PoCs to pressure-test vendor claims—market hype rarely matches operational reality.

VP of IT6 days ago

Hi Tatiane!  In order for me to answer your question correctly, I want to be sure you are asking about a SaaS SPM (Strategic Portfolio Management) tool similar to the one offered through ServiceNow.  Please confirm. 

Content you might like

Do you allow access to workday/HR application outside of InTune or another MDM tool?

What is your policy for hourly employees accessing Workday ‘off hours’? How is this policy managed?

Read More Comments

What does the current business application landscape look like at your organization?

All packaged apps13%

Mostly packaged apps, some custom apps37%

An even mix of custom and packaged apps31%

Mostly custom apps, some packaged15%

All custom apps1%

None of the above1%

View Results

Is there sufficient funding in your budget for device security?

Yes, funding is more than sufficient.19%

Yes, funding is sufficient.65%

No14%

Other (please comment)

View Results

Our organization is subject to data retention requirements over very long periods (50 years or more). Do your organizations face similar constraints? If so, what long-term retention strategy have you implemented for these regulated data, and what technologies or solutions do you use to ensure their durability and compliance?