Question

An information security manager discovers that several business units have independently purchased SaaS applications that store customer data, with no security review performed before contracts were signed. To prevent this from recurring, what is the MOST effective action?

Accepted Answer

Embed mandatory security requirements and review gates into the enterprise procurement process before contracts can be executed

Answer

Issue a company-wide memo reminding staff that unauthorized SaaS purchases are prohibited

Answer

Conduct a post-implementation security assessment of each SaaS application already acquired

Answer

Require the affected business units to attend additional security awareness training