Security review checklist for software companies

Would your next deal clear security review?

A checklist for the controls enterprise buyers check first, the evidence they ask for, and the vendors they want to see. About ten minutes, no form to fill in.

By continuing, you agree to our cookie policy.

See all 15 questions

The controls buyers check first

  1. Is multi-factor authentication required for every employee on email, code repositories and production systems?
  2. Can customers sign in with single sign-on?
  3. Is customer data encrypted in transit and at rest?
  4. Are access rights to production reviewed on a schedule?
  5. Do you run a penetration test at least once a year?

Evidence ready before you're asked

  1. Is the evidence for each control kept in one place?
  2. Are your security policies written, approved and dated?
  3. Do you reuse approved answers to security questionnaires?
  4. Can you send a security packet the same day a buyer asks?

Subprocessors and vendors

  1. Do you keep a current list of subprocessors that handle customer data?
  2. Is that list updated when you add or remove a vendor?
  3. Has each subprocessor been reviewed for security?
  4. Do you tell customers when your subprocessors change?

Response

  1. Do you have a written incident response plan that has been tested?
  2. Do you know what your contracts promise customers about breach notification?