Vendor Security Assessment Checklist for SaaS Buyers
Every SaaS tool you adopt gets some access to your data. Assessing vendors does not need to mean a 300-question spreadsheet. This checklist covers what matters most, whether you are buying software or preparing to be assessed.
1. Compliance and attestations
- Does the vendor have a SOC 2 Type 2 report, ISO 27001 certificate, or both?
- Does the report cover the product you are buying?
- Are there exceptions noted, and how were they addressed?
- Is the report current, typically covering a period ending within the last year?
2. Independent security testing
- When was the last penetration test of the product?
- Did it include authenticated testing and APIs?
- Were critical and high findings remediated and retested?
- Do they test continuously or after major releases?
3. Data handling
- What data will the vendor store, and where geographically?
- Is data encrypted in transit and at rest?
- Who at the vendor can access customer data, and is access logged?
- What subprocessors are used?
- How is data deleted when the contract ends?
4. Authentication and access control
- Does the product support SSO and enforce MFA?
- Are roles and permissions granular enough for least privilege?
- Are customer tenants isolated, and has isolation been tested?
- Are audit logs available to customers?
5. Application and infrastructure security
- Is there a secure development process, including code review and dependency scanning?
- How quickly are critical vulnerabilities patched?
- Are cloud environments configured with least privilege and monitored?
- Is there a vulnerability disclosure programme or bug bounty?
6. Incident response
- Is there a documented incident response plan?
- What is the breach notification timeline?
- Has the vendor had a security incident, and how was it handled?
7. Business continuity
- Are backups taken and restores tested?
- What are the recovery time and recovery point objectives?
- Is there an uptime commitment?
Risk-tier your vendors
Not every vendor needs the full checklist. Tier them by data access:
| Tier | Example | Assessment |
|---|---|---|
| High | Processes customer or employee personal data, or has production access | Full checklist plus reports |
| Medium | Internal business data, no production access | Compliance report and key questions |
| Low | No sensitive data | Basic questions |
If you are the vendor
Use this list in reverse to prepare. The vendors that close enterprise deals fastest can answer every section above with a link or attachment. A recent, verified penetration test report covers section 2 entirely and strengthens sections 4 and 5. SecurityInfinity can produce one in about ten minutes. Get a pentest report.
Frequently asked questions
How often should vendors be reassessed?
High-risk vendors annually, or when their service or your use of it changes significantly. Lower tiers can be reviewed less often.
What if a vendor refuses to share a pentest report?
Many share a summary or attestation letter under NDA rather than the full report. A refusal to share anything is a warning sign.
Is a SOC 2 report enough on its own?
It covers a lot, but it may not detail application testing. Ask for pentest evidence separately for high-risk vendors.