SaaS Security Checklist
Business Manager’s Checklist for SaaS Security
YES NO OTHER CHOICES COMMENTS
MULTIPLE CLOUD PROVIDERS
Are you using cloud applications and services
from multiple cloud providers? How many?
Are you aware of possible increased risk
associated with every integration point with each
unique cloud provider?
Does your current cloud provider offer seamless
integration cloud services to help you connect
your applications easily and securely? If yes,
what services do they offer?
Does your cloud provider allow you to easily and
securely access your data across multiple cloud
environments?
How often do you meet with IT staff about Not often Weekly
security?
Monthly Quarterly
Annually
APPLICATION PERFORMANCE
Does your current cloud provider co-mingle
customer data causing slow system
performance and increased risk? (i.e. one
shared database for all customer data)
Have you experienced prolonged unexpected
cloud application downtime? At peak seasonal
business times?
(Comment)
What are current cloud provider's availability
guarantees? Is credit given for non-performance?
ADVANCED SECURITY RESOURCES
Do you have recently trained, experienced
cloud security staff and budget to
manage IT security?
Does your cloud provider continuously develop
advanced security options as threat tactics
change?
Does your cloud provider offer advanced
automated SaaS security monitoring services that
detect malicious users and alert across cloud
applications and cloud providers?
YES NO OTHER CHOICES COMMENTS
DATA CENTERS & DATA RESIDENCY
Do you run, manage, secure your own data
centers? Have you measured the cost?
Does your cloud provider have multiple data center
locations around the world?
(Comment)
What are your challenges for meeting GDPR
requirements? (i.e. citizens located or data located in
the European Union)
AUDIT READINESS
Do you have challenges in meeting regulatory,
policy and compliance requirements?
How do you currently manage governance, risk and
compliance requirements?
– Manually?
– Are spreadsheets and emails used?
– Fully automated
How often do you reference standards for security
compliance? (i.e. SOC, HiTrust, NIST,etc)
Not Often Quarterly Annually
Could you benefit from more logging and automation
for reporting during security audits?
KNOW YOUR DATA / MANAGING BREACHES
Do you have a risk assessment process
documented for cloud providers?
Only during Revisit
If yes, how often do you use?
buying process Regularly
Do you know what data types you currently have and
their level of security importance? (PII, credit card,
HR data, financial data)
What are you doing to raise employee awareness (Comment)
around security?
How often do you conduct regular security checks as Monthly Weekly
an organization?
Annually Quarterly
Are there policies in place for guidance on
phishing emails?
Are you aware of any sensitive data breaches within
your organization?
What are the reporting policies and timeframes,
(Comment)
if a breach occurs?
YES NO OTHER CHOICES COMMENTS
GLOBAL ACCESS CONTROLS
Can you consistently onboard and offboard
your global workforce as needed, with audit
tracking?
Does your cloud provider offer centralized
identity management and federated single
sign-on capabilities?
How do you currently manage access across (Comment)
multiple cloud applications?
Does your current cloud provider disallow data
visibility to all of its administrators?
Does your current cloud provider practice least
privilege practices (users see only data that’s
related to their job-specific duties) and denied by
default (automatically denied unless otherwise
modified)?
SOME COMPANY
RESPONSIBILITIES
Does your company have security policies,
standards and procedures, to protect your
data such as:
– Up-to-date antivirus and malware checks
performed on files before importing or uploading
data to the cloud
– Implement best practice processes to maintain
role-based user accounts and access
Adequate physical/network security and
monitoring to prevent unauthorized access and
reduce risk from real time threats such as:
– Intrusion detection software
– Global access controls
– Firewalls
– Autonomous management tools
Instructions: If you answered "no" to any of these questions or commented answers, you may be incurring additional risk for
your business. Consider a risk consultation or assessment from a qualified cloud provider.
Oracle is here to help you with answers to all your cloud provider questions.
Phone: +1.800.633.0738 or contact your Oracle Sales Representative at:
https://www.oracle.com/corporate/contact
For more information please visit: https://www.oracle.com/applications/
