Risk Profile
Data Access Level
As a SaaS vendor selling to an enterprise test
, what type of data do you need access to?
Restricted (i.e. highly confidential information such as PII, personal identifiable information)
Impact Level
What is the potential impact to your enterprise customer if the data and/or functionality you, as the vendor, are supposed to manage, is compromised?
Substantial
Recovery Time Objective
What is your recovery time objective in case of critical failure? (e.g., your DB is deleted)
24 – 48 hours
Recovery Point Objective
What is your recovery point objective in case of critical failure? (e.g., your DB is deleted)
24 – 48 hours
Critical Dependence
Will your product be a system that your enterprise customer critically depends on? (i.e., a failure would cost them a ton of money)
No
Third Party Dependence
Are you also using other third-party services to manage or support your customers?
Yes
Hosting
Are you hosted only on one of the major cloud providers or do you have any on-premise systems?
Major Cloud Provider (e.g., AWS)
