Ensure Cloud Security in a SaaS Environment

The cloud is no longer a trend, but reality. Software as a Service (SaaS) offers major business and IT benefits that organizations are urgently trying to take advantage of.
For security professionals and leaders there are still major concerns. All too often an organization has decided to migrate some part of the business into a SaaS environment without major consultation or consideration of the security implications.
SaaS programs are of special concern due to the ambiguity of what vendors will provide for security controls and how a consumer can even begin to determine and validate any controls.
Security is the last and still largest obstacle to cloud adoption. Privacy and compliance concerns become exacerbated when control is lost.

Our Advice

Critical Insight

Handing off data doesn’t hand off responsibility. You must become your vendor’s auditor to get the security controls and confidence you need.
You can’t glue on security after the fact. Include security in SaaS negotiations.
Your SaaS vendor can often provide better security controls than you can.

Impact and Result

The business is adopting a SaaS program and that environment must be secured, which includes:
- Ensuring business data cannot be leaked or stolen.
- Securing the network connection points.
- Maintaining privacy of data and other information.

Use the SaaS vendor to cover some security controls through contractual and configuration requirements to limit the internal controls that must be deployed.
This blueprint and associated tools are scalable for all types of organizations within various sectors.

Ensure Cloud Security in a SaaS Environment Research & Tools

1. Determine SaaS risk profile

Gain an understanding of the major implications of adopting a SaaS program and what this means for the organization's security.

2. Determine SaaS security control requirements

Determine a customized list of security controls specific to the organization's needs.

3. Create SaaS security requirements documents

Prepare requirements documents for the internal SaaS project team and potential SaaS vendors.

4. Evaluate SaaS vendors from a security perspective

Determine which cloud vendors are most appropriate for security needs.

5. Implement the secure SaaS program

Communicate effectively with stakeholders to ensure proper implementation of security controls for the SaaS program.

6. Build a SaaS governance program

Ensure the continued maintenance of the SaaS program's security.

Ensure Cloud Security in a SaaS Environment visualization

The devil’s in the details when realizing full value from a SaaS program.

About Info-Tech

Info-Tech Research Group is the world’s fastest-growing information technology research and advisory company, proudly serving over 30,000 IT professionals.

We produce unbiased and highly relevant research to help CIOs and IT leaders make strategic, timely, and well-informed decisions. We partner closely with IT teams to provide everything they need, from actionable tools to analyst guidance, ensuring they deliver measurable results for their organizations.

What Is a Blueprint?

A blueprint is designed to be a roadmap, containing a methodology and the tools and templates you need to solve your IT problems.

Each blueprint can be accompanied by a Guided Implementation that provides you access to our world-class analysts to help you get through the project.

Table of Contents

Need Extra Help?
Speak With An Analyst

Get the help you need in this 1-phase advisory process. You'll receive 5 touchpoints with our researchers, all included in your membership.

Call 1: Determine your SaaS risk profile

Determine your SaaS risk profile based on your organization's variables.
Call 2: Determine your SaaS vendor completeness

Evaluate security controls and establish SaaS vendors’ security capabilities to determine safety completeness.
Call 3: Determine your SaaS vendor auditability and governability

Build criteria for evaluating SaaS vendors’ certification, accreditation and security testing to determine transparency and audit levels.
Call 4: Determine your SaaS vendor interoperability

Establish evaluation attributes for SaaS vendors’ interoperability to determine portability levels.
Call 5: Build your SaaS security governance program

Determine the continuing procedures and policies that should be developed and deployed for continual security.