SaaS Vendor Audit Checklist

SAAS AUDIT

SaaS Audit Checklist

SAAS VENDOR AUDIT

VENDOR: _______________
Product: _______________
Audit date: _______________
Auditor: _______________

SECURITY:
☐ SOC 2 Type II current (expires: _____)
☐ ISO 27001 certified
☐ Penetration test recent (<1 year)
☐ Encryption at rest: ☐ Yes ☐ No
☐ Encryption in transit: ☐ Yes ☐ No
☐ SSO/SAML supported: ☐ Yes ☐ No
☐ MFA available: ☐ Yes ☐ No

DATA:
☐ Data location known: _______________
☐ Data ownership: ☐ Us ☐ Shared ☐ Vendor
☐ Data export available: ☐ Yes ☐ No
☐ Data deletion process documented
☐ Backup/recovery documented

COMPLIANCE:
☐ GDPR compliant: ☐ Yes ☐ No ☐ N/A
☐ CCPA compliant: ☐ Yes ☐ No ☐ N/A
☐ HIPAA compliant: ☐ Yes ☐ No ☐ N/A
☐ DPA signed: ☐ Yes ☐ No
☐ Privacy policy reviewed

OPERATIONAL:
☐ Uptime last 12 months: ____%
☐ Major incidents: _____
☐ Status page available: ☐ Yes ☐ No
☐ Support SLA met: ☐ Yes ☐ No

SaaS Risk Assessment

Risk Area	Status	Risk Level
Security posture		☐H ☐M ☐L
Data protection		☐H ☐M ☐L
Availability		☐H ☐M ☐L
Vendor viability		☐H ☐M ☐L
Lock-in risk		☐H ☐M ☐L

Audit Findings Summary

AUDIT SUMMARY

Overall risk: ☐ Low ☐ Medium ☐ High

FINDINGS:
| # | Finding | Severity | Remediation |
|---|---------|----------|-------------|
| 1 | | ☐H ☐M ☐L | |
| 2 | | ☐H ☐M ☐L | |
| 3 | | ☐H ☐M ☐L | |

RECOMMENDATION:
☐ Continue as-is
☐ Continue with remediation
☐ Replace vendor

---