SaaS Vendor Security Questionnaire

An editable 20-page questionnaire for Word and Google Docs. The 16 Enhanced questions are for vendors that process sensitive data, affect operations, hold privileged access, expose APIs or use subprocessors.

What’s inside

• Twelve domains: service scope, governance and assurance, identity and access, data protection, privacy, application and API security, cloud operations, logging and monitoring, incident response, resilience, third parties and contracts, and AI and automation
• Identity questions written for SaaS: SSO over SAML or OIDC, MFA for administrators and privileged support access, role-based access, user lifecycle, and service accounts and API tokens
• The evidence each question expects, such as a SOC 2 Type II covering the service in scope, a restore test, an authenticated penetration test, and a subprocessor list with locations
• One AI question covering customer data use, model training, human review, prompt retention and opt-out controls
• An exit question naming the steps, from disabling users and terminating integrations to returning data, deleting it and preserving the audit evidence, with a worked example on a SaaS HR platform

The last pages show the same review running on SAFE’s TPRM platform. See how SAFE handles TPRM.