9 SaaS Governance Best Practices You Should Follow

Following the best practices for SaaS governance can be a hard quest to undertake. After all, there are a lot of components to consider. Depending on your business goals, the state of your software stack, and company culture, some may be more important than others. 

Hopefully you have some form of governance already. Whether you’re getting started or upleveling your governance strategy, follow the nine best practices we’ve curated below.

First, let’s define SaaS governance. It’s the processes and practices that businesses establish to identify, control, manage, and mitigate the use of subscription-based software within the organization. Watch the video for a more detailed rundown of the definition and how to implement governance.

The primary goals of SaaS governance are to avoid security and compliance risks, reduce costs, and ensure effective investments, and for good reason:

• According to Gartner, organizations without central management of SaaS are 5x more susceptible to cyber incidents. 
• One in six employees expense SaaS, creating sprawling costs and apps across the business.
• The average cost of a data breach is now $4.35 million globally or $9.44 million in the US.

Follow These SaaS Governance Best Practices

#1 Identify and Monitor Your SaaS Inventory

The fact is that you can’t manage what you can’t see. So any SaaS governance strategy that relies on less than complete visibility of your SaaS stack is guaranteed to fail. You must have a complete inventory of your SaaS to implement effective governance.

But how do you achieve full visibility of your SaaS stack?

SaaS inventories are always changing. Our data shows that an average of 6 new SaaS applications enter an organization’s stack every 30 days. Thus, not only do you need to achieve full visibility of your SaaS stack, but you also need to actively monitor your stack for the long term.

This is where a tool like Zylo’s Discovery Engine comes in handy. It accurately and perpetually identifies your SaaS stack, giving you the visibility you need to implement other SaaS governance best practices.

#2 Determine the Right Approach for Your Organization

As we mentioned earlier, governance practices can have varying mileage depending on your organization’s circumstances. Finding the right approach for your organization is a best practice unto itself. 

The SaaS governance spectrum ranges from decentralized to centralized governance, with Freedom within a Framework landing in the middle. On one side, fully centralized means your environment is essentially locked down. IT has oversight and management of all apps.

On the other end is decentralized, where employees are encouraged to buy the tools they need. Freedom within a Framework is the best of both worlds. IT has complete oversight but enables the business to access the tools it needs within a set of guardrails. 

Where does your organization fall on the spectrum? Find out by taking this governance quiz.

#3 Establish a Process for Managing SaaS Acquisitions

SaaS management is a team sport, so all the right players should be involved. You need people reviewing and approving applications before they enter your environment. Involve key stakeholders where necessary, such as IT, security, legal, and procurement.

Establishing a review process helps normalize the acquisition process across the business. The benefits of a review process include avoiding: 

• Security risks associated with non-compliant software
• Costs related to duplicate or redundant software
• Employee-led purchases

There are a few ways you can approach software purchase reviews. 

• Establish a review board
• Put a limit on expense reimbursements – or ban expense reimbursements altogether
• Put a purchase moratorium in place until governance is implemented more fully

#4 Standardize Your Software

Our next best practice for SaaS governance is application standardization. That means establishing a set of preferred software for your business. It’s often the first big step toward long-term governance of your SaaS stack. 

A few benefits of identifying preferred software helps:

• Alleviate IT’s administrative burden
• Cut costs
• Reduces shadow IT
• And more!

Standardizing your technology involves getting visibility into all SaaS in your stack, identifying a list of standard software titles, and rationalizing your portfolio to reduce the number of apps within it. Adobe is a perfect case study of how enterprises can standardize their technology to unlock its benefits.

#5 Offer Employees an Application Catalog

Giving employees a centralized place to find and request software helps curb rogue purchases, ensures users have the right access, and creates a positive experience for employees. It’s also the perfect way to enforce the use of your standardized business tools and technologies as we mentioned above.

An application catalog can be huge for unlocking productivity and boosting employee efficiency. It can:

• Help drive awareness of business tools
• Fast-track employee onboarding
• Give users clear lines of communication with admins or app owners

Zylo’s App Catalog is a streamlined tool for companies to integrate application catalogs into their employee tech experience in a seamless and unobtrusive manner.

#6 Understand Your Security Posture

Knowing your security posture is key to preventing data breaches and security complications. TechTarget defines security posture as “an organization’s overall cybersecurity strength and how well it can predict, prevent, and respond to ever-changing cyberthreats.” Pretty important, agreed?

To understand your security posture, you need to understand your SaaS stack. Thus, visibility is critical to enabling this best practice and for keeping ongoing tabs on your environment.

Keep these things in mind to improve your security posture:

• Get a full inventory of your applications and know each app’s vendor risk score.
• Understand what type of authentication system you’re using.
• Look at free apps in use and determine how they can be authenticated.
• Enforce with SAML, if possible.

And, security postures don’t need to be a complex beast to understand. Zylo’s Netskope-powered Security Detail makes understanding your security posture even easier.

#7 Rightsize and Rationalize Your Portfolio

Rationalization is key to reducing SaaS sprawl by removing applications from your stack, whether by canceling them outright or sunsetting them in lieu of a tool with similar functionality. Rightsizing is similar to rationalization but matches license size to utility, rather than reducing the number of apps.

Implementing both rightsizing and rationalization has several key outcomes:

• More efficient use of licenses
• Smaller SaaS footprint, which equals reduced costs
• Fewer doors for bad actors to enter
• More unified collaboration across the company

#8 Communicate Transparently with the Company

Communication is key to enforcing governance. When users understand why your governance policies are important and what role they play in them, they’re more likely to support the effort.

Communicate when you first roll out your new framework and keep communicating about it after, too. Find ways to keep people informed about the governance and update them on changes to it. For example, a great time to start the governance conversation is when new employees join the company.

#9 Measure Program Effectiveness

And, of course, the last best practice is to monitor your other governance practices and see if your strategy is working. You want to measure key metrics for SaaS governance, like: 

• Reduction in shadow IT
• Cost avoidance
• Reduction of applications with rationalization

You can track these metrics and see if your governance strategy is having the desired effects, then modulate your strategy going forward.

Implement SaaS Governance Best Practices to Unlock Efficiency & Reduce Risk

Hopefully, you’ve identified some—or all—of these SaaS governance best practices that you want to implement within your organization. There are plenty of tools to help you in your governance journey. Dive into our ebook on Evolving Your SaaS Governance Framework for the Digital Workplace to learn more.