Date: 27 February 2025
As software as a service (SaaS) solutions become increasingly popular, it is crucial to securely incorporate them into an organisation’s cybersecurity framework. Of course, SaaS carries many benefits, such as flexibility, scalability, and cost-saving effects. Yet it also introduces security risks that need to be addressed.
In this article, we give you an overview of SaaS, its security implications, best practices to integrate SaaS into some cybersecurity frameworks, and key SaaS security capabilities that you should look for when narrowing down on vendors.
The Rise of SaaS Adoption
SaaS solutions deliver software applications over the internet rather than having them installed locally on users’ devices or an organisation's servers. For businesses looking to optimise their cloud strategy, SaaS technology consulting can provide valuable guidance on selecting and implementing the right solutions.
Well-known examples include email, collaboration tools, customer relationship management (CRM), human resource systems, and more. The primary benefits of SaaS include:
- Cost-effectiveness – No large upfront investment in hardware/software resources
- Flexibility – Services can scale up and down based on usage needs
- Increased Mobility – Users can access SaaS from any internet-connected device
- Regular Updates – Vendors manage updates behind the scenes
According to recent surveys, SaaS is currently responsible for around 70% of company software use. Adoption continues to accelerate as more applications move to the cloud. With this growth comes a massive increase in sensitive data flowing outside the traditional network perimeter. Organisations must account for SaaS security within their cybersecurity frameworks to protect this critical information.
Cybersecurity Frameworks
Cybersecurity frameworks provide structured sets of guidelines to manage information security risks. They outline industry best practices for technologies, policies, and processes based on common standards. Three of the most widely adopted frameworks include:
NIST Cybersecurity Framework (NIST CSF)
Developed by the National Institute of Standards and Technology (NIST), this framework takes a risk-based approach built on identifying, protecting, detecting, responding to, and recovering from cyber threats. It provides a common language to communicate risks across an organisation. The NIST CSF helps organisations align cybersecurity with business requirements, risk tolerances, and resources.
ISO 27001
The International Organization for Standardization (ISO) has published ISO 27001, which is the ISO standard that specifies the requirements for an ISMS. It proposes a systematic approach for managing company and customer-sensitive data by periodically assessing risk and making continuous improvements to the process. Companies can pursue ISO 27001 certification to demonstrate compliance.
CIS Critical Security Controls (CIS Controls)
Maintained by the Center for Internet Security (CIS), this framework defines a prioritised set of cybersecurity best practices focused on threat prevention, detection, and response. The controls provide specific actions that organisations can take to strengthen their defence against cyber attacks.
All of these frameworks inform how to think about SaaS security as part of a good cybersecurity programme. It provides a structured way to assess and control the security controls, processes, and technologies that are critical to securing critical assets in the expanding SaaS ecosystem.
Integrating SaaS Security into Frameworks
While tremendously valuable, SaaS introduces new complexity in security management. Public cloud environments mean IT teams relinquish full control and visibility. Therefore, how can organisations safely integrate SaaS? Below is a list of best practices that align with the major cybersecurity framework.
NIST CSF Mapping
The NIST CSF is particularly suited for the inclusion of SaaS solutions due to its flexible structure. To start, conduct a full inventory of SaaS apps sanctioned by the business and any unsanctioned "shadow IT." Add each app as an asset in the Identify category.
Next, use the Protect function to define security requirements for SaaS:
- Access controls (user provisioning/de-provisioning processes)
- Data protection controls (encryption, tokenization)
- Application security posture
SaaS configuration options and complementary tools are used to implement controls.
Detect and respond to major SaaS platforms and high-value data. Use SaaS monitoring and analytics tools to log critical user and data events. Plan and report about an incident response.
Finally, the Recover function defines the backup and restore procedures for SaaS data. Regularly perform failover testing and renew the recovery plans of services offered in the SaaS architecture.
ISO 27001 Implementation
ISO 27001's comprehensive approach helps instill rigorous SaaS management:
- Define SaaS security requirements through a structured risk assessment methodology.
- Create an inventory of approved/unapproved SaaS apps as part of the ISMS.
- Establish data classification schema and protection levels in policies.
- Build security requirements into SaaS procurement processes.
- Implement access controls and multi-factor authentication per data classification levels.
- Encrypt sensitive SaaS data in transit and at rest.
- Continuously monitor user activities, access attempts, and data events.
- Keep asset inventory, asset data flows, security architecture, disaster recovery procedures etc.
ISO 27001 certification proves that an organisation has taken necessary controls and formalised SaaS as part of the governance process.
CIS Controls Application
The CIS Controls have a strong foundation in cyber risk management. Ensure SaaS security aligns with key concepts:
- Inventory and classify SaaS apps to understand the scope.
- Assess SaaS posture against applicable Controls (data protection, access management, monitoring, etc.)
- Identify and prioritise gaps – which introduces the most risk?
- Establish a SaaS security roadmap oriented to "First Six" Controls.
- Implement new technical controls and policies to address gaps.
- Validate effectiveness through audits and testing.
- Report status against controls to key stakeholders.
For example, Control 3 (secure configurations), Control 16 (account monitoring), and Control 17 (data protection) can be applied to harden the security posture across all SaaS apps.
Essential SaaS Security Capabilities
Beyond integrating SaaS into governance frameworks, organisations need layered defences tailored to cloud risks. As part of cyber resilience strategies, IT leaders should assess SaaS vendors across key capability areas:
Data Security
- Encryption of sensitive fields, files, and communication channels
- Tokenization to conceal sensitive data from providers
- Backup and recovery options
Access Control
- Contextual access policies based on users, roles, devices, locations, etc.
- Multi-factor authentication support
- Automated user lifecycle management integrations
Threat Protection
- Cloud access security broker (CASB) functionality
- Runtime application self-protection (RASP)
- Anomaly detection through user/entity behaviour analytics (UEBA)
Compliance & Governance
- Security certifications (ISO 27001, SOC 2, etc.)
- Configuration guidance for hardening posture
- Audit trail capturing user activities, access attempts, and data events
Operations & Visibility
- Security monitoring with alerts and reporting
- Workflow automation options
- Open APIs for manageability and visibility
Filling the security gaps that the cloud introduces requires selecting SaaS vendors that offer advanced capabilities in these areas. Mature solutions permit organisations to apply similar controls and visibility to both on-premises and SaaS footprint. It's advisable to ensure that providers use best practices for cyber risk management with technology innovation and framework support.
Conclusion
The adoption of SaaS brings a lot of business value. For enterprise security teams to benefit securely, they need strategies to take into account new risks. Just as NIST CSF, ISO 27001 and CIS Controls work on-prem, they apply equally well to SaaS IT.
Organisations can safely take advantage of the cloud by continuously tightly integrating SaaS through discovery, assessments, control implementation, and testing. To keep up with SaaS expansion, you need both technology controls and updated processes to evolve security.
