A third-party and SaaS risk-governance checklist for businesses

The Vietnam Airlines breach through a third-party platform exposed an uncomfortable truth: your own systems can be perfectly secure, yet data still leaks through a vendor you don't control. This is a practical checklist for governing third-party and SaaS risk — something every organization running service software needs, even without an incident.

Why third-party risk matters

Every CRM, chatbot, email-marketing tool or cloud store you use is a place where customer data flows beyond your direct control. OWASP Top 10:2025 just added the category A03 Software Supply Chain Failures — recognizing this as one of today's biggest application-risk groups.

The hard part: you can't "patch" this risk with a product. It requires a governance process that runs continuously. Below is a checklist organized by the lifecycle of a vendor relationship.

1. Before signing: vendor due diligence

• Assess the vendor's security — certifications (ISO 27001, SOC 2), incident history, how they handle vulnerabilities.
• Define the data shared — what data the vendor will touch, and how sensitive it is.
• Check where it's stored — data location; any in-country storage obligation (Decree 53/2022).
• Contract terms — breach-notification duty (within how long), audit rights, and how data is handled/deleted at contract end.

2. On integration: control tokens and scope

• Inventory integrations — every OAuth/API connection to a third-party platform must be recorded: who owns it, what it's for.
• Minimize scope — grant only the minimum permissions an integration truly needs, not full access for convenience.
• Minimize data shared — push only the fields a function needs; don't sync full customer records.
• Manage secrets — store tokens and API keys securely, never hard-coded in source or exposed config.

3. In operation: continuous monitoring

• Review tokens periodically — revoke unused integrations; rotate keys on a schedule.
• Monitor abnormal access — unusually large data exports over a CRM/SaaS API should raise an alert (the key signal in the 2025 Salesforce data thefts).
• Access logs — log who accessed and which integrations are active, for traceability.
• Track vendor advisories — subscribe to the security-notification channels of your critical SaaS providers.

4. On incident: response and notification

• A ready response plan — who does what when a vendor reports a breach; two-way points of contact.
• PDPL notification duty — have a personal-data breach-notification process ready under the Personal Data Protection law, not built mid-crisis.
• Customer playbook — notification templates and advice (change passwords, watch for phishing) prepared in advance.

5. Periodically: lifecycle governance

• Re-assess vendors — periodically review the SaaS inventory, remove tools no longer used ("shadow SaaS").
• Update the data map — which data sits on which SaaS, and whether it's still needed.
• Run a drill — test a "vendor breach" scenario to check your response process.

If resources are limited, do these first

No organization does everything at once. Three high-impact, low-cost moves:

1. Inventory your OAuth/SaaS integrations — you can't protect what you don't know you have.
2. Revoke unused integrations and tokens — cut excess attack surface immediately.
3. Turn on abnormal-export monitoring — the earliest sign of a third-party leak.

Conclusion

Third-party risk doesn't disappear when you stop thinking about it — it just becomes invisible. A checklist run regularly turns "hoping the vendor is secure" into "knowing where you're exposed and how far you control it". For sensitive data, add one more step: keep what matters most in systems you control, rather than pushing everything to outside platforms.

If you want to review third-party risk and strengthen application and API defenses, book a consultation to assess against your actual systems.