SaaS (Software as a Service)
Software as a Service (SaaS) is software you use over the internet through a subscription and a login, such as Microsoft 365 or Gmail, where the provider runs everything behind it. Under Cyber Essentials v3.3 it is always in scope (A2.9), and you remain responsible for secure configuration and user access control, including MFA (A7.16, A7.17).
- Term
- SaaS
- Also known as
- SaaS, Software as a Service, Cloud software
- Category
- Malware, cloud and threats
- Requirement area
- D(iv) Cloud services
- Questions
- A2.9A7.16AUTO-FAILA7.17AUTO-FAIL
- Reviewed against
- Requirements v3.3
What does the term SaaS mean in Cyber Essentials?
Software as a Service (SaaS) is software you use over the internet through a subscription and a login, such as Microsoft 365 or Gmail, where the provider runs everything behind it.
Software as a Service (SaaS) – the cloud provider delivers applications, and your organisation then configures the services. You must still make sure that the service is configured securely. Examples of SaaS include Microsoft 365, Dropbox and Gmail
How does SaaS apply to Cyber Essentials?
In plain terms
SaaS is like renting a furnished flat. The landlord looks after the building, the wiring and the boiler. You decide who gets a key and how the rooms are used. Microsoft 365, Google Workspace, Xero, Dropbox and your CRM are all examples: nothing to install on a server, just a login in a browser or app.
What Cyber Essentials asks
SaaS is one of the three cloud service types in the requirements, and cloud services "cannot be excluded from scope". Every SaaS service you use goes in A2.9. The A2.9 guidance adds that social media accounts such as Facebook, LinkedIn and X count as cloud services too.
Table 1 of the requirements shows who typically implements each control for SaaS:
| Control | Typically implemented by |
|---|---|
| Firewalls | The cloud provider |
| Secure configuration | Both your organisation and the cloud provider |
| Security update management | The cloud provider |
| User access control | Your organisation |
| Malware protection | The cloud provider |
The applicant organisation "is always responsible for ensuring all controls are implemented". Where the provider implements one, its commitment must be in contractual clauses or documents referenced by contract.
Common mistakes
- Leaving smaller services off A2.9, such as a payroll portal or a company social media account.
- Leaving MFA off for some accounts. Where a service offers MFA, A7.16 (administrators) and A7.17 (users) are automatic fails if answered No.
See cloud services scope and Microsoft 365 setup. Related: cloud service, shared responsibility model.
Related terms
- Cloud serviceA cloud service is an on-demand, scalable service hosted on shared infrastructure, reached over the internet through an account, that stores or processes your organisation's data.
- Shared responsibility modelA shared responsibility model is a cloud provider's written explanation of which security tasks it handles and which ones remain the customer's job.
- SandboxingSandboxing is running a program inside a sealed-off space on a device, so that anything it does cannot reach the rest of the system or your data.
- Security operations centre (SOC)A security operations centre (SOC) is a team, in-house or outsourced, that watches an organisation's systems for signs of attack and responds when something suspicious happens.
- Signature-based detectionSignature-based detection is the way anti-malware software recognises known malware, by comparing files against a list of fingerprints, called signatures or definitions, supplied by the vendor.
- Social engineeringSocial engineering is manipulating people, rather than hacking computers, to get them to hand over information, money or access, usually by pretending to be someone they trust.
Frequently asked questions
Software as a Service (SaaS) is software you use over the internet through a subscription and a login, such as Microsoft 365 or Gmail, where the provider runs everything behind it. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, SaaS comes up at A2.9, A7.16, A7.17. Read those questions against the definition above so your answers use the term the way the assessor will.
SaaS relates to D(iv) Cloud services in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.