We categorize scores into three risk levels:

• Low Risk (0-35): Minimal risk with no significant threats to security or operations.
• Medium Risk (36-64): Moderate risk with potential issues that should be addressed.
• High Risk (65-100): Significant risk requiring immediate action to mitigate security and operational threats.

The total score is made up of 10 scoring criteria that represent the common factors that SaaS companies consider when conducting risk assessments. Please see below for detailed information on how Sastrify defines and scores each criterion.

1. Security Posture

   Evaluation: Evaluate security practices and certifications.

   Weight: 15

   • 0: Holds recognized security certifications (e.g., ISO 27001, SOC 2) and employs robust security measures.
   • 50: Implements basic security measures without formal certifications.
   • 100: Lacks adequate security measures; no certifications.

2. Financial Stability

   Evaluation: Examine financial health and sustainability.

   Weight: 10

   • 0: Strong financial health; profitable and stable.
   • 25: Good financial health; growing revenue but not consistently profitable.
   • 50: Moderate financial health; some concerns about sustainability.
   • 100: Poor financial health; significant financial risks.
3. Data Protection Compliance

   Evaluation: Assess compliance with GDPR and other relevant data protection regulations.

   Weight: 20

   • 0: Fully compliant with all data protection regulations (e.g., GDPR, CCPA).
   • 50: Partially compliant; some gaps in policies or implementation.
   • 100: Non-compliant; significant violations or lack of policies.
     

4. Vendor Reputation and History

   Evaluation: Assess market reputation and historical performance.

   Weight: 10

   • 0: Excellent reputation, strong market presence, and positive feedback.
   • 25: Good reputation; mostly positive feedback but with some minor issues.
   • 50: Mixed reputation; some negative feedback or incidents.
   • 100: Poor reputation; unresolved issues or scandals.

5. Business Continuity and Disaster Recovery

   Evaluation: Evaluate the robustness of continuity and recovery plans.

   Weight: 10

   • 0: Comprehensive, documented, and regularly tested plans.
   • 50: Plans exist but are incomplete or infrequently tested.
   • 100: No formal plans in place; unprepared for disruptions.

6. Regulatory Compliance

   Evaluation: Check compliance with industry-specific regulations (e.g., HIPAA, PCI DSS).

   Weight: 10

   • 0: Fully compliant with all relevant industry regulations (e.g., HIPAA, PCI DSS).
   • 50: Partially compliant; working towards full compliance.
   • 100: Non-compliant; disregards industry regulations.

7. Operational Maturity

   Evaluation: Assess the maturity of operational processes.

   Weight: 5

   • 0: Highly optimized processes (e.g., CMMI Level 5).
   • 50: Defined, established processes with room for improvement.
   • 100: Poor operational maturity; ad-hoc or chaotic processes.

8. Supply Chain Risks

   Evaluation: Analyze risks associated with third-party dependencies.

   Weight: 5

   • 0: Strong control over suppliers and partners.
   • 50: Some controls are in place, but gaps exist.
   • 100: High risk; poor control over third-party dependencies.

9. Incident History

   Evaluation: Review past security incidents and responses.

   Weight: 10

   • 0: No significant incidents; proactive risk management.
   • 25: Minor incidents resolved effectively.
   • 50: Major incidents that were resolved but impacted operations.
   • 100: Unresolved or recurring incidents; poor incident management.

10. Support and Maintenance Capabilities

    Evaluation: Evaluate the quality and reliability of support services.

    Weight: 5

    • 0: Excellent support; high customer satisfaction and responsiveness.
    • 25: Good support; reliable but with occasional issues.
    • 50: Adequate support; noticeable delays or limitations.
    • 100: Poor support; frequent complaints or unavailability.