SaaS Vendor Quick Assessment (10-Minute)

# SaaS Vendor Quick Assessment **Use this for**: Medium and low-tier vendors (no customer PII or production access) **Time to complete**: ~10 minutes --- **Vendor Name**: ________________________ **Service Provided**: ________________________ **Date**: ________________________ --- | # | Question | Answer | Notes | |---|---|---|---| | 1 | Do you hold SOC 2 Type II or ISO 27001 certification? | ☐ Yes ☐ No | | | 2 | Is data encrypted at rest and in transit? | ☐ Yes ☐ No | | | 3 | Is MFA available/enforced for user accounts? | ☐ Yes ☐ No | | | 4 | Is SSO (SAML/OIDC) supported? | ☐ Yes ☐ No | | | 5 | Where is customer data stored? (Region) | ________ | | | 6 | Can we export and delete our data? | ☐ Yes ☐ No | | | 7 | Do you have a published privacy policy? | ☐ Yes ☐ No | URL: ________ | | 8 | Will you sign our DPA? | ☐ Yes ☐ No | | | 9 | Have you had a data breach in the last 3 years? | ☐ Yes ☐ No | | | 10 | Do you perform regular penetration testing? | ☐ Yes ☐ No | | | 11 | What is your committed uptime SLA? | ________% | | | 12 | How quickly do you notify of security incidents? | ________ hours | | | 13 | Do you use sub-processors for our data? If so, who? | ☐ Yes ☐ No | | | 14 | Do you carry cyber liability insurance? | ☐ Yes ☐ No | | | 15 | Can you provide audit reports upon request? | ☐ Yes ☐ No | | --- ### Scoring Guide | Score | Risk Level | Action | |---|---|---| | 13-15 Yes | Low Risk | Approve — annual review | | 10-12 Yes | Medium Risk | Approve with conditions | | 7-9 Yes | High Risk | Require remediation plan | | < 7 Yes | Critical Risk | Do not approve | --- *Assessed by: [Name]* *Decision: ☐ Approved ☐ Conditional ☐ Rejected*