Small business security
The security questions to ask a software supplier
Every app you adopt and every supplier you give access to becomes part of your security. Most small businesses sign up for software without asking anything at all. You don’t need a 200-question form, just a handful of questions that reveal whether a supplier takes security seriously.
The short version
Ask at least these
- Where is our data stored, and who can access it?
- Do you support MFA and single sign-on?
- How will you tell us about a breach, and how fast?
- Can we export our data if we leave?
Why it matters
Breaches at software suppliers and service providers have affected thousands of Australian businesses and their customers. When your supplier is breached, it’s still your customers who are affected, and you may still have obligations to them.
The core questions
Your data
- Where is our data stored, and in which country?
- Who at your company can access it, and is that access logged?
- Is it encrypted in transit and at rest?
- How long do you keep it after we stop using the service?
Access and accounts
- Do you support multi-factor authentication? Can we require it for all our users?
- Do you support single sign-on with Microsoft or Google?
- Can we set different permission levels for different staff?
- Can we see an audit log of who did what?
Incidents
- Have you had a security breach? What happened and what changed?
- How quickly will you notify us if our data is affected?
- Who do we contact for security issues?
Resilience
- How do you back up our data, and how quickly can you restore it?
- What uptime do you commit to, and what happens if you miss it?
Leaving
- Can we export all our data in a usable format at any time?
- What happens to our data when we leave?
If the supplier will access your systems
Suppliers who connect to your network or accounts, such as IT providers, developers or software support, deserve extra questions:
- Will each person have their own login with MFA?
- Will access be limited to what they need, and removed when the work ends?
- What tools will they use to connect, and how are those secured?
See also choosing a managed IT provider.
What good answers look like
Specific, written and quick. A supplier that can point you to a security page, explain its MFA options and describe its breach notification process is usually a better bet than one that says “we take security very seriously” and nothing else.
Scale the questions to the risk
| Supplier | How much to ask |
|---|---|
| A design tool with no customer data | A few basic questions |
| Email, file storage, accounting or CRM | All the core questions |
| Anyone with access to your systems or sensitive data | Core questions plus the access questions, and get answers in writing |
Keep a simple register
A spreadsheet listing each supplier, what data or access they have, who owns the relationship and when you last reviewed them. It makes offboarding, incident response and client questionnaires much easier.
Common questions
Does data need to be stored in Australia?
Not always. It depends on your obligations, contracts and clients. Know where it is, and check whether any of your clients require Australian storage.
A big, well-known supplier won’t answer our questions directly.
Large providers usually publish security and compliance documentation instead. Read it, and check the settings you control, like MFA.
What about free tools staff sign up for themselves?
Agree which tools are approved, and make it easy for staff to ask before they adopt new ones.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.