In this video, you’ll see how you can simplify software-as-a-service (SaaS)
risk assessment with AWS Marketplace Vendor Insights.
From a unified dashboard, you can view vendors’ security and compliance
information and evaluate individual compliance controls to streamline
the procurement process.
Let’s begin by taking a quick look at the AWS Marketplace Vendor Insights page.
This page summarizes the benefits of Vendor Insights to both enterprise
customers and software vendors and answers frequently asked questions.
Let’s discover products with Vendor Insights profiles.
These results include only SaaS products with Vendor Insights security profiles.
We can filter further to see only those with product certificates.
These products all have SOC 2 Type 2 and ISO 27001 certificates.
Let’s view a product.
The product overview now includes Vendor Insights information.
This link takes us to the product’s Vendor Insights profile on AWS Marketplace.
The profile includes a high-level overview and shows the certifications
the vendor has received and their expiration dates.
Let’s look at the Security and compliance tab.
To access to this vendor’s data, we’ll need to request access.
Let’s complete the form.
Before we continue, let’s review the next steps.
The seller will contact us directly about completing a non-disclosure agreement (NDA).
The seller will notify AWS Marketplace when our NDA is completed,
and we will then be granted access to insight data.
For our purposes, let’s view a vendor profile to which we’ve
already been granted access.
Let’s view the product.
In the overview, we can find public documentation the vendor supplied,
including a link to a security feed.
The link opens a new tab where we can browse the vendor’s security bulletins.
Let’s go back.
This vendor also provided a link to its service availability status, which,
in this case, points to an AWS Health Dashboard.
Let’s return to the seller’s Vendor Insights page and view the Security
and compliance dashboard.
Vendor Insights gathers evidence- based information about 140
industry-standard security controls.
The page provides details for each control category.
The summary reveals how many of the vendor’s controls are validated
with evidence or based on self- reported evidence, and whether
any controls are non-compliant.
Let’s take a closer look at the data security category.
First, we’ll drill into the data encryption controls.
Control compliance is determined by three sources:
Workloads on AWS are validated by AWS Config and AWS Audit Manager.
Please note that these are production workloads and they are updated bi-weekly.
Compliance or non-compliance is also evaluated against industry-standard
audit reports as the second source.
And finally, vendors self-assess their own compliance as the third source.
Let’s review the first control.
Here we find more information on the evidence provided and control status.
Let’s return to the main product page.
This time we’ll look at a non-compliant control in the data security category.
We see the vendor self-reported that customer data is transmitted
to countries outside the origin country.
Let’s view the control for more information.
The vendor has supplied an annotation explaining why its procedures are non-compliant.
Access to this level of information improves procurement speed and
trust when evaluating third-party products.
You’ve just seen how you can
simplify SaaS risk assessment with AWS Marketplace Vendor Insights.
You can learn more about this topic in the description and links for this video.
Thanks for watching. Now it's your turn to try.