SaaS inventory maintained
Demonstrate that the organization maintains an accurate, complete, and current inventory of all SaaS applications in use, including discovery mechanisms for shadow IT and regular validation processes.
Description
What this control does
This control ensures the organization maintains a current, comprehensive inventory of all Software-as-a-Service (SaaS) applications in use across the enterprise, including sanctioned and shadow IT applications. The inventory typically includes application names, owners, business purposes, user counts, data classifications, vendor information, and integration points. Maintaining this inventory is critical for managing third-party risk, enforcing access controls, preventing data exfiltration through unsanctioned channels, and enabling effective incident response.
Control objective
What auditing this proves
Demonstrate that the organization maintains an accurate, complete, and current inventory of all SaaS applications in use, including discovery mechanisms for shadow IT and regular validation processes.
Associated risks
Risks this control addresses
- Unauthorized SaaS applications containing sensitive data remain unmonitored and unprotected, leading to data breaches or compliance violations
- Shadow IT circumvents security controls such as DLP, encryption, and access management, creating uncontrolled exfiltration paths
- Duplicate or redundant SaaS subscriptions increase attack surface and waste financial resources without visibility
- Incident response teams lack awareness of all SaaS applications, delaying containment and forensic analysis during security events
- Third-party vendor risks go unassessed when SaaS applications are deployed without procurement or security review
- Departing employees retain access to undocumented SaaS applications, creating persistent unauthorized access channels
- Compliance gaps emerge when auditors discover unmanaged SaaS applications processing regulated data outside approved controls
Testing procedure
How an auditor verifies this control
- Request the current SaaS application inventory document or system, including fields for application name, vendor, owner, data classification, user count, and last review date
- Review the documented process or procedure for discovering, documenting, and maintaining the SaaS inventory, including responsibilities and update frequency
- Examine evidence of automated discovery tools or methods used to identify shadow IT, such as CASB logs, DNS query logs, firewall logs, or SSO provider analytics
- Select a sample of 10-15 SaaS applications from the inventory and verify each entry contains complete required fields and current information
- Cross-reference the inventory against alternative sources such as SSO logs, payment/procurement records, and IT ticketing systems to identify undocumented applications
- Interview business unit representatives and IT staff to identify any SaaS applications in use that do not appear in the inventory
- Review evidence of periodic inventory validation activities, such as quarterly reviews, owner attestations, or automated reconciliation reports from the past 12 months
- Verify that newly identified SaaS applications from the testing process are documented and escalated according to the organization's procedures
Where this control is tested