What is the review process followed by your company while choosing SaaS products? Does the security team do an audit of the product - if so how do they evaluate the product?

Question

Answer

While it isn't always possible to do a pre-contract review, our security department does work closely with our procurement department to provide this analysis up front. Occasionally though, SasS services have been acquired outside of the standard procurement process.

But even post-contract we do regular reviews, based on three stages: a self-assessment by the vendor, a screening by our security team (we have a dedicated team for screening third parties), and of course independent validation by a proper auditing firm.

The screening we do is based on the publicly exposed information and infrastructure, as well as information provided by the SaaS vendor.

We currently see that as part of a vendor risk management process, which also has other areas in it (such as evaluating the financial maturity of the company, geographical and political risks, etc.)

Answer

Yes Audit the product Assess its security, Vendor image in market, and industry certifications if any. In order to minimize the investment risk.

What is the review process followed by your company while choosing SaaS products? Does the security team do an audit of the product - if so how do they evaluate the product?

Content you might like

Do you trust the data & reports from the big analysts?

What factors do you consider when evaluating job security in a company?

Can anyone recommend a firm to provide enterprise/corporate training that is customized, instructor-led, and class focused on mobile app development using React Native? Do you have any feedback on the following providers: Knowledgehut, Nobleprog, or Developintelligence?

What are 5 Key Insights for Third-Party Risk Management Design and Governance?