Software-as-a-Service (SaaS) often saves your customers time and money and offers rapid response to dynamic business demands. In an increasingly impatient world, you can expect demand for SaaS products to continue to grow. But this growth opportunity is a double-edged sword.
With the growing prevalence and publicity of security breaches, your customers expect comprehensive security that doesn’t sacrifice user experience. This is not limited to technological minimums like encryption; it trickles over to who on your staff has access to the data within the application and how that process is managed. The controls you put in place are critical.
Give and take. SaaS is growing market with growing expectations.
Security of the cloud is hard to debate – AWS, Azure and Google invest heavily in securing their public clouds. The documentation is extensive but that responsibility doesn’t extend all the way to your application. You also have a shared responsibility with your application. If you hold anyone’s sensitive data within your application, you are responsible. You face compliance mandates for data protection such as PCI-DSS, HIPAA, GDPR and state data breach notification laws.
This isn’t all meant to scare you. It is just to show you that security can’t be a second thought. Your customers are turning to SaaS for ease of use and scalability. They will entertain a demo or a free trial, but understand they are going to have specific questions around how you will store their information before they move their operations to your platform.
Who handles penetration testing. How, and how often, is it done?
What are the sign-on, access and authentication policies?
What encryption policies will protect data as it is transferred, or when it is being stored?
Is there a single-tenant hosting option separated from that of other customers?
What is the backup and recovery plan?
How well does the provider’s security policy match my company’s (if my company has one)?
SaaS providers are likely to face a number of compliance and certification requirements when consider the data they are taking in.
Taking credit cards to charge accounts? PCI DSS is a requirement.
For a complete overview of navigating different certification and compliance requirements, click here.
JupiterOne’s was built for cloud-native applications. The framework was created for our own cloud platform with the goal of achieving and maintaining HIPAA compliance and HITRUST CSF certification in a quick and sustainable way without having to onboard a large security team or compliance consultants. After seeing the success both in end result and time savings throughout the process, we knew JupiterOne needed to be shared.
Want to see how security simplified can unlock growth in your SaaS organization?