The 50-Point Vendor Security Assessment Checklist

Enterprise procurement teams use detailed security questionnaires to evaluate SaaS vendors. This checklist covers the 50 most common questions so you can prepare your answers before the questionnaire arrives.

Infrastructure Security (1-10)

Do you use encrypted connections (TLS 1.2+) for all data in transit?
Is data encrypted at rest using AES-256 or equivalent?
Do you maintain a network architecture diagram?
Are production environments isolated from development?
Do you use a WAF (Web Application Firewall)?
Is your infrastructure hosted in SOC 2 certified data centers?
Do you have DDoS protection in place?
Are backups encrypted and tested regularly?
Do you support data residency requirements (EU, US)?
Is your DNS configured with DNSSEC?

Application Security (11-20)

Do you perform regular vulnerability scans?
Do you follow the OWASP Top 10 guidelines?
Is there a secure software development lifecycle (SSDLC)?
Do you conduct penetration testing at least annually?
Are security findings tracked and remediated with SLAs?
Do you have a bug bounty or vulnerability disclosure program?
Are all dependencies scanned for known vulnerabilities?
Do you use static and dynamic application security testing?
Is input validation enforced on all user inputs?
Are API endpoints authenticated and rate-limited?

Access Control (21-30)

Do you support SSO (SAML, OIDC)?
Is multi-factor authentication enforced for admin access?
Do you follow the principle of least privilege?
Are access rights reviewed quarterly?
Is there role-based access control (RBAC)?
Do you have an offboarding process that revokes access?
Are API keys rotated regularly?
Do you support IP allowlisting?
Are admin actions logged and auditable?
Is there session management with timeout policies?

Compliance & Governance (31-40)

Are you SOC 2 Type II certified (or in progress)?
Are you ISO 27001 certified?
Do you comply with GDPR?
Do you have a Data Processing Agreement (DPA)?
Is there a formal information security policy?
Do you conduct regular security awareness training?
Do you have a risk management framework?
Are third-party vendors assessed for security?
Do you maintain a data classification policy?
Is there a formal change management process?

Incident Response (41-50)

Do you have a documented incident response plan?
Is there a 24/7 security monitoring capability?
What is your notification timeline for security incidents?
Do you conduct post-incident reviews?
Is there a disaster recovery plan with defined RTOs?
Do you maintain business continuity procedures?
Are incident response procedures tested annually?
Do you have cyber insurance?
Is there a designated security team or officer?
Can you provide evidence of your last security audit?

How SaaSFort Automates This

Many of these questions can be answered automatically with continuous security scanning. SaaSFort generates Deal Reports that pre-answer questions 11-20 with real scan data, saving weeks of manual evidence gathering.

Ready to prepare your security evidence? Start your free scan and get audit-ready in hours, not weeks.

The 50-Point Vendor Security Assessment Checklist for SaaS