Layer8 practical worksheet
Supplier and SaaS review worksheet
Clarify administrative ownership, data handling, continuity, notices and an orderly exit before purchase or renewal.
Make the first discussion useful.
Ask the same practical questions for each important provider. Record verified answers, documents and unanswered questions before committing to a service, renewing it or transferring ownership.
Prepare before the discussion
- The provider, service purpose, organizational owner and renewal date.
- A category-level description of records and important service dependencies.
- Available agreements, support terms and provider security information.
Work through the prompts.
Assign organizational ownership
Identify the business owner, technical administrator, contract contact and person authorized to renew or cancel. Avoid subscriptions that depend on a former volunteer's personal account.
Describe the information involved
Record data categories, permitted purpose, integrations and subcontractor questions. Use no real personal records in the worksheet.
Confirm account controls
Ask about MFA, individual administration, role permissions, access logs and recovery. Identify what the organization must configure and maintain.
Check access lifecycle
Confirm how staff, volunteer and provider access is approved, reviewed and removed. Include delegated and integration access.
Clarify continuity and backups
Distinguish provider availability from recoverability of the organization's data. Ask about restore scope, retention, export, recovery access and any separately required backup service.
Understand support and notices
Record support hours, escalation routes and contractual incident-notice responsibilities. Confirm the organization's contact and after-hours decision owner.
Review evidence with context
Record the date and scope of provider assurance documents. Identify exclusions and unanswered questions; a logo or report title alone does not prove the organization's configuration is sound.
Plan data retention and disposal
Clarify deletion, backup retention, legal preservation and confirmation at contract end. Ask who can authorize and verify the outcome.
Rehearse the exit
Confirm usable export formats, transfer ownership, administrative account removal and dependency cleanup. Plan an authorized synthetic export check where available.
Make a documented decision
Record verified answers, material unknowns and the owner of follow-up work. Agree purchase, renewal or remediation with explicit responsibility and a review date.
Agree the result and the next action.
Use these outputs to judge whether the preparation is useful:
- A supplier record with ownership, responsibilities, verified evidence and open questions.
- A continuity and exit outline matched to the service's operational importance.
- A documented purchase or renewal decision and the next review date.
Review prompt: Use before purchase or renewal and after changes in ownership, data use, integrations or material service terms.
Record the next decision
Use your secure workspace to record the issue, what you know, who is responsible and what happens next. Add a due date and a way to check completion. The PDF includes a printable worksheet.
Use the guide within an agreed scope.
Edition 1.0 · Updated October 4, 2026
This preparation worksheet does not replace contract review or a provider audit. Agree evidence requests and any testing with authorized provider and organizational owners.
Primary references for further reading
These are original Layer8 preparation prompts. The linked organizations do not endorse this guide.
Bring the question. Agree the work.
Cybersecurity can help scope this work. Assess the authorized scope, prioritize improvements and verify agreed safeguards.