INDUSTRY FACT FILE · SAAS & ENTERPRISE SOFTWARE

Cybersecurity FAQs for SaaS and Enterprise Software Vendors

Forty frequently asked questions and answers in five categories, written for founders, CTOs, CISOs, product, engineering, sales and compliance teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: Regulation, certification and contracts 3.  Category 3: Product, API and tenant security 4.  Category 4: Cloud, SOC and incident response 5.  Category 5: Privacy, vendors and AI

Audience: Founders, CEOs, CTOs and CISOs

Q1. Why are SaaS platforms attractive targets?

One platform holds many customers' data, so a single flaw in isolation, APIs, integrations or support tools can expose them all.

Q2. What are the biggest risks?

Tenant isolation flaws, broken API authorisation, account takeover, integration token theft, support-tool abuse, vulnerable dependencies and cloud misconfiguration.

Q3. Which incidents illustrate the risk?

Credential-based access to customer accounts without MFA on a major data platform (2024), a large identity provider's support-system breach (2023) and OAuth token theft from a chat integration (2025).

Q4. Who owns product security?

Engineering owns secure delivery; the CISO owns assurance and monitoring; leadership owns risk appetite and investment.

Q5. How does security affect sales?

Enterprise buyers run security reviews and often require SOC 2 or ISO 27001, test reports and incident commitments before signing.

Q6. What should leadership review?

Test results and closure, isolation and API findings, dependency risk, incidents, SOC metrics and certification status.

Q7. How should we prioritise investment?

Start with product VAPT, tenant isolation, MFA by default and SCA; then add SOC 2, managed SOC and red teaming.

Q8. How can Codec Networks help?

Codec Networks provides product VAPT, SAST/DAST/SCA, API and tenant isolation testing, cloud security reviews, SOC 2 and ISO 27001 readiness and managed SOC.

Audience: Compliance, legal and sales teams

Q9. Do CERT-In Directions apply to SaaS vendors?

Yes. They require six-hour incident reporting and 180-day ICT log retention in India for service providers and body corporates.

Q10. What are CERT-In's SBOM guidelines?

CERT-In issued technical guidelines on software bills of materials in October 2024, setting out recommended SBOM practices.

Q11. How does DPDP affect SaaS vendors?

As processors you must apply safeguards on customers' instructions; for your own users you act as a data fiduciary. Most obligations take effect in May 2027.

Q12. Do BFSI customers' regulators affect us?

Yes, through contracts: RBI, SEBI and IRDAI require regulated entities to manage vendors and cloud services, often with audit rights.

Q13. Should we get SOC 2 or ISO 27001?

Many vendors pursue both: SOC 2 is often requested by US and global buyers; ISO/IEC 27001 is widely recognised internationally and in India.

Q14. Does the EU Cyber Resilience Act apply?

It applies to products with digital elements placed on the EU market; pure SaaS is largely outside its scope, but downloadable software and connected products may be covered. Reporting obligations apply from September 2026.

Q15. What about selling to government?

Cloud services for government use are typically empanelled by MeitY; confirm current empanelment requirements.

Q16. Can Codec Networks test our product for customers?

Yes. Codec Networks is CERT-In empanelled and produces customer-ready product test reports with retests.

Audience: CTOs, engineering and product teams

Q17. How should tenant isolation be enforced?

Bind the tenant from the authenticated session on the server, never trust client-supplied tenant IDs, and isolate caches, exports and background jobs.

Q18. How do we test isolation?

Use multi-tenant test accounts to attempt cross-tenant access across every endpoint and automate these tests in CI.

Q19. What should API testing cover?

Authentication, object-level and function-level authorisation, rate limiting, input validation, error handling and data minimisation.

Q20. How should OAuth integrations be governed?

Use minimal scopes and short-lived tokens, review partner security, monitor bulk exports and support fast revocation.

Q21. How do we secure support access?

Use just-in-time, customer-approved access, phishing-resistant MFA, device posture checks and customer-visible audit logs.

Q22. What is business-logic testing?

Testing workflows—approvals, payroll runs, refunds—for ways to bypass rules, which automated scanners usually miss.

Q23. How do we manage dependencies?

Scan with SCA, generate an SBOM per release, monitor advisories and define patch SLAs.

Q24. Should MFA be on by default?

Yes, at least for administrators, with options for SSO and phishing-resistant methods.

Audience: Platform, DevOps and security operations teams

Q25. What cloud controls matter most?

Least-privilege IAM, private storage, network segmentation, secrets management, IaC scanning and continuous posture monitoring.

Q26. How do we secure Kubernetes?

Harden clusters, restrict privileges, scan images, enforce network policies and monitor runtime activity.

Q27. What should our SOC monitor?

Identity events, admin and support actions, API usage and exports, cloud control-plane changes and production alerts.

Q28. What should incident playbooks include?

Containment, customer notification, log sharing, evidence preservation and CERT-In reporting within six hours.

Q29. How long must logs be retained?

CERT-In requires ICT logs for a rolling 180 days within India; customers may require longer and access to their own audit logs.

Q30. How should we prepare for ransomware?

Isolate and test backups, protect the control plane and rehearse restoring tenants.

Q31. How do we handle DDoS?

Use upstream protection, rate limiting and capacity testing, and agree SLAs with providers.

Q32. Should we run tabletop exercises?

Yes—especially for tenant data exposure, integration compromise and support-tool scenarios.

Audience: Privacy, vendor management and AI teams

Q33. What is a data processing agreement?

A contract setting out how you process customer personal data, including security, sub-processors, breach notice and deletion.

Q34. How should sub-processors be managed?

Assess them, list them for customers, include flow-down clauses and review them periodically.

Q35. How do we handle data deletion?

Support customer deletion requests and delete data at contract end, including backups within defined periods.

Q36. What AI risks apply to SaaS features?

Prompt injection, cross-tenant retrieval, data leakage to model providers and excessive permissions for AI agents.

Q37. How do we test AI features?

Test for prompt injection and data leakage, enforce tenant boundaries in retrieval and restrict AI agent permissions.

Q38. Should customer data train our models?

Only with clear contractual rights and transparency; many enterprise customers prohibit it.

Q39. How do we publish security information?

A trust centre with certifications, test summaries, sub-processors and policies speeds up security reviews.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your product, tenant model, integrations and certification calendar; Codec Networks will propose a testing and assurance plan.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal or regulatory advice. Confirm obligations against the official instruments and your customer agreements.