Free resource

SaaS security checklist.

Forty-seven security controls for software companies, covering access, data, applications, infrastructure, compliance and incident response.

01
Find the gaps
47 controls across the six areas buyers and auditors ask about.
02
Set priorities
Start with access and basic application security.
03
Keep it on file
Print it or save it as a PDF to share with your team.

The 47-point checklist.

Authentication & access

01Multi-factor authentication is required, especially for admins
02Passwords are long, unique and checked against known breaches
03Single sign-on is available for business customers
04Roles follow least privilege
05Sessions time out and use secure, HTTPS-only cookies
06Repeated failed logins are slowed or blocked
07API keys can be rotated and revoked, and their use is audited
08Admin actions are logged in a record that can’t be edited
09Third-party sign-in is reviewed and limited to what you need
10Access is reviewed on a regular schedule

Data protection

11Data is encrypted at rest
12Data is encrypted in transit
13Databases are private, with limited and logged access
14You know where personal and sensitive data is stored
15A written policy says how long data is kept
16Backups run automatically and restores are tested
17Test environments don’t use real customer data
18File uploads are checked, limited and stored safely
19You can detect sensitive data leaving your systems
20Payment and other high-risk data is tokenized
21You can delete a person’s data on request
22You know which regions hold your data

Application security

23All input is validated on the server
24Security headers are set
25Dependencies are scanned for known vulnerabilities
26Every change gets a code review
27Automated security testing runs in your pipeline
28APIs are rate limited
29Errors don’t reveal internal details to users
30Independent penetration tests run on a regular schedule

Infrastructure & DevOps

31Networks are segmented between environments
32Firewall rules allow only what is needed
33Container images are scanned and kept minimal
34Infrastructure is defined in code and reviewed
35Secrets live in a secrets manager, not in code
36Patches are applied on a defined schedule
37A web application firewall protects public apps
38Your CDN is configured securely
39Monitoring alerts a person when something is wrong

Compliance & governance

40Your privacy policy matches what you actually do
41Your terms of service are current
42Vendors are assessed for risk
43Staff receive regular security training
44You know which certifications your buyers expect

Incident response

45A written incident response plan exists and has been rehearsed
46You know who to notify after a breach, and how quickly
47Logs are kept long enough to investigate an incident

44 more items

See the full checklist.

Enter your email to reveal all 47. We'll also send you three short emails on this topic over the next ten days. Unsubscribe any time.

Found gaps?

Get them tested and fixed.

We run penetration tests and security reviews, and we can fix what we find.

Ask about a security review