# Review a SaaS supplier's security with evidence, not a checkbox Published by Britixo | 2026-10-29 | Security & Microsoft 365 Canonical page: https://britixo.com/business-guides/saas-supplier-security-review/ Review the service you will actually buy, the information it will handle and the access it will receive. Use proportionate questions backed by relevant evidence, then record the remaining risks and who accepts them. A certificate or a completed questionnaire is useful only within its stated scope. A stronger decision includes the operating arrangement after purchase: who configures access, receives incident notices, tests exports and reviews material changes. ## When this guide is useful Procurement, IT and business teams choosing a cloud application or renewing an important service - Procurement has a certificate but cannot map it to the proposed product or location. - The supplier will receive customer data, yet no one has drawn the data flow. - A service is becoming business-critical without a recovery or exit plan. - A long questionnaire produces reassuring answers but few verifiable documents. ## Classify the purchase before sending a questionnaire Write a brief service profile covering users, data types, integrations, administrator access and business consequence if the service fails. A public design tool and a system holding confidential customer records should not receive identical scrutiny. Identify the internal business owner and the people responsible for security, privacy and commercial approval. NCSC supply-chain guidance encourages organisations to understand and manage supplier risk over time. Turn that into a proportionate review: decide which questions are essential for this use and what evidence would answer them. Keep the assessment tied to the proposed service boundary, rather than the supplier's broad corporate marketing. ## Ask for evidence that matches the risk For identity and access, ask how your administrators will enforce authentication, assign roles and remove access. For integrations, establish the permissions required, credential ownership and available audit records. For resilience, ask what service commitments, recovery arrangements and export mechanisms apply to your subscription and data. When reviewing independent assurance, check the named entity, covered product or operations, period, exclusions and current status. A hosting provider's certificate does not automatically certify the SaaS application or your configuration. If detailed reports require a confidentiality agreement, agree who can review them and how the resulting decision will be recorded without redistributing restricted material. ## Resolve responsibility and contractual gaps Translate the technical answers into a responsibility table. Include account administration, configuration, data location, incident notification, support access, subcontractors and deletion at exit. NCSC's cloud principles provide a useful range of questions, but the final arrangement must be checked against the service documentation and contract. Document unanswered questions and proposed mitigations before purchase. A mitigation might be limiting the data uploaded, reducing an integration's permissions or requiring a supported export. Record the owner who can accept the remaining risk and any condition that must be met before live use. Do not silently convert an unknown answer into a pass. ## Keep the review alive through renewal and exit Set review triggers such as a new AI feature, new integration, ownership change, different processing location or a major incident. Ask the business owner whether actual usage has expanded beyond the original approval. A low-risk tool can become a critical record system simply because staff start relying on it. Test the exit route while the relationship is healthy. Confirm what records, attachments, metadata and configuration can be exported and how they can be used elsewhere. Include costs, time limits and any supplier assistance needed. Keep renewal decisions connected to this evidence rather than treating security review as a document completed only at onboarding. ## Prepare for a useful conversation - A service profile showing data, users, integrations and business impact. - Required evidence mapped to the specific product and subscription. - A responsibility table covering configuration, incidents, support and exit. - An exception register with owners, decisions and review dates. - A tested export or exit sample and triggers for reassessment. ## How Britixo can help Britixo can help structure the technical part of a supplier review, assess integration permissions and translate requirements into an implementable operating model. A scoped engagement can produce a service profile, evidence-gap register, access design and practical exit or migration considerations. We can also help remediate configuration gaps after a supplier is selected. Contact Britixo with the proposed service, intended data use and any procurement requirements. Independent certification, legal review, commercial negotiations and acceptance of business risk remain separately defined responsibilities; a technical review does not create a blanket compliance assurance. [Contact Britixo](https://britixo.com/contact/?enquiry_type=contact_consultation#contact-form) ## Common questions ### Is an ISO certificate enough to approve a SaaS service? Not by itself. Check its entity, scope and validity, then assess the specific product, configuration and contractual responsibilities relevant to your use. ### Should every supplier complete the same questionnaire? A common baseline helps consistency, but the depth should reflect access, data and business impact. Excessive irrelevant questions can obscure the important unanswered ones. ### What if the supplier will not provide a full audit report? Ask what alternative evidence is available and record the remaining uncertainty. The authorised risk owner should decide whether limits, mitigations or another supplier are appropriate. ## Related guides - [UK data residency: questions to ask before choosing hosting](https://britixo.com/business-guides/uk-data-residency-hosting-decisions/) - [Employee onboarding and offboarding: close the access gaps](https://britixo.com/business-guides/employee-onboarding-offboarding-access/) - [Fix SharePoint oversharing without stopping useful collaboration](https://britixo.com/business-guides/sharepoint-permissions-oversharing/) ## Sources and further reading - [NCSC: Supply chain security guidance](https://www.ncsc.gov.uk/collection/supply-chain-security) - [NCSC: The cloud security principles](https://www.ncsc.gov.uk/collection/cloud/the-cloud-security-principles) Prepared with AI assistance and checked against linked primary documentation. [Editorial approach](https://britixo.com/business-guides/#editorial-approach). Product availability and delivery scope are confirmed for your requirements.