Business Requirements
Cloud Security Software Business Requirements
112 testable requirements for choosing cloud security platforms (CSPM, CIEM, CWPP and code scanning), with a vendor response form, demo script and weighted scorecard in Excel.
What this requirements workbook is for
A requirements workbook lists what a product in this category must do, written so a vendor can answer each line and you can check the answer.
Teams use it to build the requirements section of an RFP, to run scripted demos, and to score vendors side by side on the same terms.
It pairs with the buyer guides Cloud Security Posture Management (CSPM) and Cloud Access Security Broker (CASB), and with the Cloud Access Security Broker (CASB) RFP Package for the software selection.
About This Requirements List
Cloud security platforms find misconfigurations, excessive permissions, vulnerabilities and active threats across cloud accounts, workloads and infrastructure-as-code, and are bought by security and cloud platform teams. This set covers configuration posture (CSPM), cloud entitlements (CIEM), workload protection (CWPP) and pipeline scanning, the parts sold together as a CNAPP, with data security posture as a Should, and leaves out network firewalls, SaaS posture and user endpoint protection.
112 requirements for choosing cloud security platforms (CSPM, CIEM, CWPP and code scanning), each written so a vendor can answer it and you can check the answer. Delivered as an Excel workbook.
Inside the Workbook
- 84 functional requirements in 12 areas, each with how to verify it
- 28 non-functional requirements written for this category
- Suggested priorities (50 Must) that you change, with weights that follow
- A vendor response form with six response types, from Standard to Not supported
- 7 scripted demo scenarios, each mapped to the requirements it tests
- A weighted scorecard for up to five vendors, by area, with Must gaps counted
Functional Areas
- Cloud inventory and coverage (7)
- Configuration posture (CSPM) (10)
- Cloud identities and entitlements (CIEM) (8)
- Workload and image vulnerabilities (10)
- Runtime workload protection (CWPP) (6)
- Code, pipeline and admission control (7)
- Data security posture (4)
- Cloud threat detection and response (8)
- Risk prioritization (4)
- Compliance reporting (5)
- Remediation and workflow (7)
- Administration and integration (8)
Deeper Vendor Due Diligence
Security, privacy, contract and exit questions are in the RFP question bank: Security, Integration & interoperability, Data protection & privacy, Deployment & hosting, Compliance & certifications, Support & operations.
Built For
IT, business and procurement teams writing requirements before a software selection, and consultancies running one for a client. The Consultancy License covers use with any number of clients.