SaaS SaaS Security and Compliance

Question 1

Which security framework is most commonly referenced for SaaS vendor compliance in the United States?

Accepted Answer

SOC 2 Type II

Answer

SOC 2 Type II is the most widely referenced SaaS security framework in the US, auditing controls over a period of time.

Question 2

What does the shared responsibility model mean for SaaS customers?

Accepted Answer

The customer is responsible for identity, access, and data governance

Answer

In the SaaS shared responsibility model, the vendor secures infrastructure and application, while the customer manages identity, access controls, and data governance.

Question 3

Which regulation governs the privacy of health information handled by SaaS applications used by US healthcare providers?

Accepted Answer

HIPAA

Answer

HIPAA (Health Insurance Portability and Accountability Act) governs the handling of protected health information (PHI) by covered entities and their business associates.

Question 4

What is a Business Associate Agreement (BAA) in the context of SaaS?

Accepted Answer

A legal contract required when a SaaS vendor handles PHI on behalf of a HIPAA-covered entity

Answer

A BAA is a legal contract required under HIPAA when a SaaS vendor processes, stores, or transmits protected health information on behalf of a covered entity.

Question 5

What is the purpose of Single Sign-On (SSO) in enterprise SaaS security?

Accepted Answer

To allow users to access multiple applications with one set of credentials

Answer

SSO enables users to authenticate once and gain access to multiple SaaS applications, reducing password fatigue and centralizing access control.

SaaS Practice Test

SaaS Practice Test

SaaS SaaS Security and Compliance