Media / Security
A security review checklist for small teams buying software
A lightweight way to check a new software vendor when you don't have a dedicated security team.
Stackpick Editorial1 min readTHE SHORT ANSWER
Match the review to the risk. Check what data the tool will touch, how people sign in, what independent proof the vendor offers, and how you would get your data back.
In this guide
01
Start with the data
A tool that holds customer records needs more scrutiny than one that schedules meetings. Write down what data it will access, then scale the review to fit.
02
The basic checks
- Single sign-on or multi-factor authentication is available
- Access can be limited by role, and removed quickly when someone leaves
- Data is encrypted in transit and at rest
- The vendor has a published security page and a way to report issues
- There's an independent audit report you can read, such as SOC 2 or ISO 27001
03
Read the contract for these
- How quickly they must tell you about a breach
- Which subprocessors they use
- How data is returned or deleted when you leave
- A data processing agreement, if you handle personal data
04
Check the permissions
When connecting a tool to your email, files or code, read what access it requests. Give the least access that works, and review connected apps regularly.
05
Keep a simple record
Note who approved each tool, what data it touches and when to review it again. A short spreadsheet is enough to start, and it helps when customers or auditors ask.
Stackpick Editorial
Practical guides for people who buy and run technology.