Security and trust at SaaSAudit

Security Policies Established and Annually Reviewed

The entity has established all required security policies, which are reviewed and approved by senior management on at least an annual basis.

Responsible Disclosure Process Defined

The entity has defined and communicated a responsible disclosure process to enable employees and external parties to report security vulnerabilities.

Incident Response Plan Established

The entity has established a documented incident response plan that defines procedures for detecting, containing, remediating, and communicating security incidents.

Incident Response Team Established

The entity has established a designated incident response team with defined roles, responsibilities, and escalation procedures.

Risk Management Policy Established

The entity has established a formal risk management policy that defines the risk management framework, methodology, and risk appetite.

Change Management Process Established

The entity has established a formal change management process to authorise, document, test, and approve changes to infrastructure, software, and procedures.

Access Control Policy Defined

The entity has defined an access control policy that establishes the principles of least privilege, role-based access, and system access authorisation requirements.

Password Policy Defined for Authentication

The entity has defined password complexity, length, rotation, and reuse requirements to govern authentication credentials across all systems.

Encryption Key Management Process Established

The entity has established a formal encryption key management process covering key generation, distribution, rotation, and revocation.

Employee Termination and Offboarding Checklist Maintained

The entity maintains a formal termination/offboarding checklist to ensure all access is revoked, equipment is returned, and confidential data is secured upon employee departure.

Physical Security Policy Established

The entity has established and maintains a physical security policy that governs access to facilities, equipment, and sensitive locations.

Data Deletion Policy Established

The entity has established a data deletion policy that defines retention periods and procedures for the secure disposal of data in compliance with regulatory requirements.

Data Retention Policy Established

The entity has established a data retention policy that defines minimum and maximum retention periods for all data classifications.

Business Continuity / Disaster Recovery Plan Established

The entity has established a documented business continuity and disaster recovery plan that defines recovery objectives, procedures, and responsibilities.

Data Backup Policy Defined

The entity has defined a data backup policy specifying backup frequency, retention periods, and recovery objectives.

Software Development Lifecycle (SDLC) Policy Defined

The entity has defined an SDLC policy that governs the design, development, testing, deployment, and maintenance of software.

Data Classification Policy Established

The entity has established a data classification policy that categorises data by sensitivity and defines handling requirements for each classification level.

Clean Desk Policy Established

The entity has established a clean desk policy requiring employees to secure sensitive materials and lock screens when workstations are unattended.

Data Protection Policy Established

The entity has established a comprehensive data protection policy that governs the collection, processing, storage, and disposal of personal and sensitive data.

Job Descriptions Maintained for Open Positions

The entity provides clear job descriptions for open positions to attract qualified candidates aligned with security and competency requirements.

Pre-Employment Background Checks Conducted

The entity requires and completes background checks for all new hires prior to granting access to systems and data.

Formal Employment Agreement Required

The entity requires all new hires to sign a formal employment agreement prior to commencement of employment.

Annual Employee Performance Evaluations Conducted

The entity conducts annual performance evaluations for all employees to assess competency and accountability.

Annual Security Awareness Training Mandated

The entity mandates annual information security awareness training for all employees and contractors to maintain security competency.

Employee Policy Acknowledgement Required

The entity requires all employees to formally acknowledge all applicable company policies on an annual basis.

System Access Revoked Upon Termination Within SLA

The entity revokes all logical and physical access for terminated employees and contractors within the defined offboarding SLA.

Security Commitments Communicated to Customers

The entity communicates its security commitments, including commitments set forth in customer agreements (MSAs), to all relevant external parties.

Product/Service Description Publicly Available

The entity makes a clear description of its products and services publicly available to inform customers and stakeholders.

Cybersecurity Insurance Maintained

The entity maintains cybersecurity liability insurance to mitigate financial exposure from security incidents and data breaches.

Security Events Communicated to Senior Management

The entity's incident response team communicates all material security events to senior management in a timely manner.

Customers Informed of Material System Changes

The entity communicates material system changes and service updates to customers in a timely and transparent manner.

Customer Support System Established

The entity has established an accessible customer support system with published contact information to address customer enquiries and issues.

Annual Penetration Testing Performed

The entity engages qualified third parties to perform penetration testing on at least an annual basis to identify and remediate security vulnerabilities.

Annual Access Control Reviews Performed

The entity performs formal access control reviews on at least an annual basis to ensure access privileges remain appropriate and aligned with current roles.

Formal Access Requests with Role-Based Access Controls

The entity requires formal access requests with documented approval for all access to critical systems, applying role-based access controls consistent with the principle of least privilege.

Test Data Used in Non-Production Environments

The entity enforces the use of non-production / anonymised test data in all testing and development environments to protect customer data.

Customer Data Deleted Upon Contract Termination

The entity ensures customer data is securely deleted upon contract termination in accordance with contractual obligations and data retention policies.

SSL/TLS Encryption Enforced

The entity enforces TLS 1.2 or higher for all data in transit and rejects connections using deprecated SSL/TLS versions.

Inactivity Logout Implemented in Applications

The entity's applications automatically terminate user sessions upon inactivity or browser exit to prevent unauthorised access.

Customer Data Logically Segregated

The entity implements logical segregation to ensure customer data is isolated and inaccessible across tenant boundaries.

Root / Privileged Account Login Restricted

The entity restricts root account usage in cloud infrastructure, ensuring the root account has not been used for console login within the last 30 days.

Quarterly Processing Capacity and Usage Review

The entity conducts quarterly reviews of processing capacity and system usage to ensure adequate resources are available to meet service commitments.

Full Disk Encryption Required on Company Devices

The entity requires full disk encryption on all company-managed devices using industry-standard technologies (FileVault, BitLocker, LUKS).

Anti-Malware Technology Deployed on Endpoints

The entity has deployed anti-malware / endpoint detection and response (EDR) technology on all company-managed devices.

Changes Tested Prior to Production Deployment

The entity requires all changes to be tested in a non-production environment and validated prior to deployment to production.

Production Code Changes Restricted to Authorised Personnel

The entity restricts write access to production branches and deployment pipelines to a defined set of authorised personnel.

Production Releases Require Authorised Approval

The entity requires formal approval from designated authorised personnel before any code release is deployed to production.

Input Validation Controls Implemented

The entity's applications enforce input validation controls, including range checks and format validation, to prevent processing of invalid data.

Mandatory Field Validation Enforced

The entity's applications enforce mandatory field validation to ensure all required data is provided before processing transactions.

Regression Testing Conducted Prior to Release

The entity performs regression testing prior to each production release to verify that existing functionality is not adversely affected by changes.

Performance Testing Conducted to Validate SLA Compliance

The entity conducts performance testing to verify that applications meet defined service level agreements under expected load conditions.

Minimal Personal Information Collected

The entity collects only the minimum personal information necessary to fulfil the stated business purpose, consistent with data minimisation principles.

Data Subject Deletion Requests Honoured

The entity processes and fulfils verified data subject requests for deletion of personal information within the required timeframe.

Identity Authenticated Before Granting Personal Data Access

The entity verifies the identity of data subjects before granting access to or disclosing their personal information.

Data Access Requests Fulfilled for Data Subjects

The entity processes and fulfils verified data access requests from data subjects, providing copies of personal information held upon request.

Personal Data Modification Requests Processed

The entity corrects or amends personal information based on verified requests from data subjects within the required timeframe.

Data Processing Agreements in Place for PI Vendors

The entity ensures all vendors processing Personal Information on its behalf have executed a Data Processing Agreement (DPA) that defines data handling obligations.

PII Data Breaches Tracked and Documented

The entity maintains a formal register to track all actual and suspected breaches of Personally Identifiable Information (PII), including investigation status and remediation actions.

Business Associate Agreements in Place for PHI Vendors

The entity ensures all vendors processing Protected Health Information (PHI) have executed a Business Associate Agreement (BAA) in compliance with HIPAA requirements.

Vendors Instructed on Data Breach Reporting for PI Data

The entity provides all vendors handling Personal Information with clear instructions on how to identify and report actual or suspected data breaches.

Data Breach Notification Process Established

The entity has established a formal data breach notification process that defines procedures for notifying affected data subjects, regulators, and other required parties within statutory timeframes.

Privacy Contact Information Publicly Available

The entity provides publicly accessible contact information for privacy-related enquiries, complaints, and dispute resolution.