An Author’s Taxonomy of Customer-Observable Security Controls in SaaS Platforms
TL;DR
A taxonomy that classifies security controls for SaaS platforms by the degree to which they are observable to the tenant is introduced, giving tenants a shared language for procurement, contractual negotiations, and continuous assurance, and gives providers a roadmap for increasing visibility into their controls.
Abstract
The software-as-a-service model places most technical security mechanisms in the provider's hands, while the customer remains accountable for data, identities, and regulatory outcomes. Certification reports describe what a provider has implemented, yet reveal little about what a tenant can monitor and verify on its own. This article introduces a taxonomy that classifies security controls for SaaS platforms by the degree to which they are observable to the tenant. The proposed scale contains four levels: directly observable controls, controls verifiable on request, attestation-only controls, and non-observable controls. The classification procedure draws on the SaaS Security Capability Framework of the Cloud Security Alliance, the Cloud Controls Matrix, NIST SP 800-53, and ISO/IEC 27001, and the scale is applied to three control domains: logging and monitoring, security incident management, together with e-discovery and cloud forensics, and identity and access management. The selection of domains mirrors the framework sections shaped through first-hand work within the Cloud Security Alliance working group. Observations from a corporate program that hardened seven SaaS platforms serving more than 100,000 active users illustrate how the scale behaves in practice. The taxonomy gives tenants a shared language for procurement, contractual negotiations, and continuous assurance, and gives providers a roadmap for increasing visibility into their controls. A systematic classification of SaaS controls along the observability axis has not been proposed before.