Research Topic

SaaS Governance

Latest ResearchWorking Group
SaaS Governance Best Practices for Cloud Customers
SaaS Governance Best Practices for Cloud Customers


SaaS Governance
Security and privacy are the primary concerns for organizations considering SaaS adoption, and recent research indicates that 77% of SaaS-adopting organizations have experienced SaaS-specific security incidents. SaaS services account for the bulk of the cloud industry market, and any security incident could critically impact cloud customers. 

SaaS services present unique risks to their cloud customers since they:
  • Are highly business process specific;
  • Handle and store critical business and personal data.
  • Integrate a broad array of service components, operating over a deep application stack.
  • May depend on multiple cloud service providers. 

Due to heavy competitive pressure in the SaaS market today, security is too often not a top priority for SaaS providers – especially for the smaller providers that may not have the necessary security expertise to identify and manage the risks that could impact cloud customers and the cloud provider’s own operations. The SaaS Governance Working Group encourages and defines mechanisms to ensure the security of customer data and the resilience of the SaaS cloud infrastructure. 

This group has already started writing the SaaS Governance Best Practice for SaaS Customers . You can preview the chapters in progress below:

Interested in what you can do to improve SaaS governance?
The Security, Trust, Assurance, and Risk (STAR) Registry allows cloud customers to view the controls implemented by popular SaaS providers. Based on the controls outlined in the Cloud Controls Matrix, providers submit the CAIQ to this publicly available registry. This allows cloud customers to easily access and assess offerings from popular cloud providers.View CSA’s registry of secure companies here. 

SaaS Governance

Discuss this topic in Circle

Have an interesting article or video on this topic that you want to share? Anyone can join the discussion community for this topic to share ideas or ask questions.

View discussion community

Participate in SaaS Governance Research

This group aims to benefit all parties in the Software-as-a-Service (SaaS) ecosystem by supporting a common understanding of SaaS related risks from the perspectives of the cloud customer and cloud service provider.

View the working group

View all

Cloud Security Research

CSA Research crowd-sources the knowledge and expertise of security experts and helps address the challenges and needs they’ve experienced, or seen others experience, within the cybersecurity field. Each publication is vendor-neutral and follows the peer review process outlined in the CSA Research Lifecycle. We recommend getting started by reading the following documents.

Cloud Octagon Model

Cloud Octagon Model

While not created by this working group, the Cloud Octagon Model helps provide context and background to SaaS Governance. The model is an approach to assess risk in SaaS cloud computing. It provides practical guidance and structure to all involved risk parties in order to keep pace with rapid changes in privacy and data protection laws and regulations, and changes in technology. 

The 2020 State of Identity Security in the Cloud

The 2020 State of Identity Security in the Cloud

The use of cloud services has continued to increase over the past decade. Particularly in the wake of the COVID-19 public health crisis, many enterprises' digital transformations are on an accelerated track to enable employees to work from home. CSA surveyed these organizations to better understand how cloud services are being used during this transition and how organizations are securing their operations over the next 12 months.

SaaS Governance Best Practice for Cloud Customers (Coming Soon!)

The SaaS Governance Best Practice for SaaS Customers is a baseline set of fundamental SaaS governance practices for SaaS Customers. It enumerates and considers risks during all stages of the SaaS adoption lifecycle and takes into account the SaaS usage lifecycle. It will also aim to provide mitigation measures from the cloud customer’s perspective.


SaaS Security Best Practices
SaaS Security Best Practices

October 6 | Online

Learn more

Why Using Common Controls Changed The Game for Nutanix & Qorus
Why Using Common Controls Changed The Game for Nutanix & Qorus

December 10 | Online

Learn more

Are we losing or gaining control of SaaS Data Access? A candid conversation between 2 leading security executives
Are we losing or gaining control of SaaS Data Access? A cand...

November 23 | Online

Learn more

Transforming Enterprise Cloud Security to Supercharge Developer Velocity
Transforming Enterprise Cloud Security to Supercharge Develo...

November 19 | Online

Learn more

Blog Posts

Study: The Truth About SaaS Security and Why No One Cares…Yet
Monitor Your SaaS Environment for Three Common SaaS Misconfigurations
What is the Cloud Security Alliance and Why Should I (as Someone Selling or Buying Cloud Services) Care?