SaaS security is the set of controls that keep each customer's data private, your platform available, and your company compliant. The stakes are high in India: IBM's 2025 Cost of a Data Breach report put the average cost of a breach for Indian organisations at an all-time high of $2.3 million, 13% more than the year before. And attackers increasingly come in through partners: Verizon's 2025 Data Breach Investigations Report found third parties involved in 30% of breaches, double the previous year.
This checklist covers what attackers actually exploit, 12 controls every SaaS product needs, India's CERT-In and DPDP reporting rules, and the questions to ask a development company.
Key takeaways
- Access control is the top risk: broken access control is number one on the OWASP Top 10:2025, and in SaaS that means one customer seeing another's data.
- Stolen credentials and unpatched software are leading ways in.
- India requires fast reporting: CERT-In expects cyber incidents to be reported within 6 hours of noticing them.
- The DPDP Rules add breach duties to the Data Protection Board and to every affected person.
- Security never finishes. Test, monitor and rehearse your incident response regularly.
What Attackers Actually Exploit
| Finding | Figure | Source |
|---|---|---|
| Breaches involving a third party | 30% | Verizon DBIR 2025 |
| Credential abuse as the initial attack vector | 22% | Verizon DBIR 2025 |
| Exploitation of vulnerabilities as the initial vector | 20% | Verizon DBIR 2025 |
| India: phishing as the top attack vector | 18% of breaches | IBM, 2025 |
| India: third-party and supply chain compromise | 17% of breaches | IBM, 2025 |
| India: organisations with AI access controls in place | 37% | IBM, 2025 |
The 12-Control SaaS Security Checklist
1. Strong identity and login
- Multi-factor authentication for all admins and available to all users.
- Single sign-on (SAML or OIDC) for business customers.
- Rate limits and lockouts against password guessing; secure session handling.
2. Tenant isolation and access control
- Enforce tenant checks in one central place, on every request and every query.
- Role-based access with least privilege; deny by default.
- Automated tests that try to read another tenant's data.
3. API security
- Authentication and authorisation on every endpoint, including internal ones.
- Object-level checks so users cannot fetch records by guessing IDs (see the OWASP API Security Top 10).
- Rate limiting, input validation and no sensitive data in URLs.
4. Encryption
- TLS for all traffic; encryption at rest for databases, backups and files.
- Managed key storage with restricted access and rotation.
5. Secrets management
- No passwords or API keys in code or chat; use a secrets manager.
- Rotate keys regularly and immediately after staff leave.
6. Secure development
- Code review for every change; security checks in the build pipeline.
- Dependency scanning and prompt patching; software supply chain failures are a new category in the OWASP Top 10:2025.
7. Third-party and supply chain risk
- Keep an inventory of every tool and service with access to your data.
- Review their security, limit their permissions, and remove unused integrations.
8. Logging and monitoring
- Central logs for logins, admin actions, data exports and permission changes.
- Alerts for unusual activity, such as mass downloads or logins from new countries.
- Keep ICT system logs for at least 180 days, as CERT-In's 2022 directions require, stored securely.
9. Incident response
- A written plan with owners, contacts and decision steps; rehearse it.
- Report cyber incidents to CERT-In within 6 hours of noticing them.
- For personal data breaches, follow the DPDP Rules, 2025: inform the Data Protection Board without delay with a detailed report within 72 hours, and inform each affected person.
10. Backup and disaster recovery
- Automated, encrypted backups stored separately from production.
- Defined recovery targets, and restore tests at least every quarter.
11. Employee and admin security
- Phishing awareness training; phishing is the top attack vector in India.
- Least-privilege admin access, separate admin accounts, and fast offboarding.
12. Payments
- Use a PCI DSS-compliant payment gateway; never store full card numbers yourself.
- Verify payment webhooks and protect billing settings with extra checks.
Security for AI Features in SaaS
If your product uses AI models, add these to the checklist. The OWASP Top 10 for LLM applications lists prompt injection and sensitive information disclosure as leading risks.
- Prompt injection: treat text from users, documents and websites as untrusted; limit what the AI can do with tools and data.
- Data leakage between customers: retrieve only the current tenant's data for each request.
- AI access controls: only 37% of Indian organisations had them in IBM's 2025 study; restrict who can use which AI features and data.
- Provider terms: confirm customer data is not used to train the model provider's models.
- Logging: record AI actions, especially any that change data or trigger payments.
A Recurring Security Routine
| Frequency | Tasks |
|---|---|
| Every release | Code review, dependency and security scans, cross-tenant tests |
| Weekly | Review alerts, failed logins and admin activity |
| Monthly | Patch servers and libraries, review user and API access, rotate exposed keys |
| Quarterly | Restore a backup, rehearse the incident plan, review third-party access |
| Yearly | Independent penetration test and policy review |
India Compliance Quick Reference
| Rule | Key requirement for SaaS companies |
|---|---|
| CERT-In directions (2022) | Report specified cyber incidents within 6 hours of noticing them; keep ICT logs for a rolling 180 days |
| DPDP Act and Rules, 2025 | Reasonable security safeguards for personal data; breach intimation to the Data Protection Board and affected people; most obligations apply after an 18-month transition |
This is a summary, not legal advice. Confirm your obligations with a lawyer.
Browse our curated list of Top Cybersecurity Companies
Pre-Launch Security Checklist
| Area | Before launch |
|---|---|
| Authentication | MFA for admins, secure sessions, rate limits |
| Tenant isolation | Central tenant checks and automated cross-tenant tests |
| APIs | Auth on every endpoint, object-level checks, rate limits |
| Data | Encryption in transit and at rest; backups tested |
| Secrets | Stored in a secrets manager, not in code |
| Monitoring | Central logs, alerts, 180-day retention |
| Incident response | Written plan, CERT-In and DPDP contacts ready |
| Testing | Vulnerability scan and an independent penetration test |
Do You Need SOC 2 or ISO 27001?
Not on day one, but enterprise customers will often ask for one of them during procurement. Building the controls above early makes certification much faster when deals require it.
Questions to Ask a SaaS Development Company About Security
- How do you enforce and test tenant isolation?
- Which OWASP risks do you test for, and how often?
- Who reviews code changes, and how are dependencies kept up to date?
- How are secrets, keys and production access managed?
- What logging and alerting will be in place at launch?
- Will you help us meet CERT-In and DPDP reporting requirements?
Find verified cybersecurity companies on UpBusiness for penetration testing and audits, compare SaaS development companies, or post your project. Building the platform itself? See our guides to SaaS application development and custom SaaS development.
The Bottom Line
Most SaaS breaches come through the same few doors, usually weak access control, stolen credentials, unpatched software or a third party. Close those first, keep logs and a rehearsed incident plan to meet India's 6-hour reporting rule, and treat security as a monthly habit rather than a launch task.
Browse our curated list of Top Cybersecurity Companies
