What kind of "security specifics" does a potential enterprise customer need to see for a SaaS?
Hi folks—I have a SaaS and I'm increasingly working with enterprise customers. They have asked about security with my SaaS, and I've given them some bulletpoints on how their data is secure with our service (various points about our data practices, that we enforce HTTPS, that we use a recognized framework with built-in protections against various classic vulnerabilities such as SQL injection attacks or cross-site scripting, etc...). Yet, someone on their side has asked if I have "something specific" they can pass on to their "security team."
I kind of want to ask them what they mean, but am worried they may think I'm too amateur to work with if I do. Any idea what this would possibly mean? I guess I'm thinking some kind of fact sheet... but what kind of fact sheets does an enterprise customer actually expect on this issue?
I appreciate any advice that people with more experience here can share.
I specifically started a service to help companies assess their vendors so I know exactly what they'll be looking for.
There are a few factors depending on what your product does that will change what they want to see from you.
I'd be happy to chat with you and point you in the right direction as to what you might need. Feel free to send me an email.
Thanks. I’m doing some processing on documents that my clients are writing; typically these documents become public within days after our processing.
My question is twofold. First, I can (from googling) guess some kinds of questions they might ask. I don’t know how deep down such a rabbit hole they might go. This seems to be what you’ve focused on.
A second aspect of my question, where I’m actually more lost, is: what kind of upfront documentation might a business considering contracting with a vendor actually expect from them? In other words what should I be telling them before they ask me any questions, and in what format? Do you have an example of such a document?
A business will assess you in two buckets.
Impact
Based on the type of data that your customer shares with you, what is the Impact that a breach would have. If they are sharing things like employee health information, private financial data or other types of sensitive data, that would be high impact. It doesn't sound like the data you have access to is very sensitive and in that case, you want to emphasize as they will initially rate you a lower risk vendor out the gate. If they rate you a lower risk vendor out the gate, they won't expect as much of you and likely won't ask too much of you either.
Likelihood
The other bucket is how likely you are to be breached. They will ask you a number of questions about your application, your infrastructure, etc. If you have necessary controls in place, they won't both you too much. If you're born in the cloud on AWS, just make sure you have all the necessary security protocols in place.
As far as what you can provide to them upfront:
-As much information as possible minimizing the impact of the type of data that you will process. Even a simple paragraph explaining it, will be helpful as the InfoSec team usually doesn't get a lot of information from the business.
-If you are hosted in AWS, you should be able to obtain things like a SOC 2 Type 2 and other AWS certifications that you can share with your customer upfront.
-Providing a checklist of all the things you do with your AWS account that ensures it's secure. Just base it off something like this:
https://d1.awsstatic.com/whitepapers/Security/AWS_Security_Checklist.pdf
-Some sort of privacy policy that is compliant w/ CCPA/GDPR. Look up a way to auto generate a privacy policy and just make sure that you state you will not sell data and you'd be willing to fulfill any requests for data. In the context of your product, this might not make any sense but customers are looking for that check the box.
The InfoSec team doesn't want to be put in a situation where they are telling the business 'no' left and right so providing the InfoSec team with this information upfront is smart. Your instincts are definitely right on that one.