SaaS Security Audit Bundle

Google Security Feature Matrix Thumbnail.png

Use this collection to find out what security features are included in your cloud software subscriptions, what’s missing, and what to turn on.

The Cloud Security Audit Toolkit:

Article: Selecting Software as a Service with Security in Mind
SaaS Security Feature Checklist
2026 Security Feature Matrix: Google Workspace by License Level
2026 Security Feature Comparison: Givebutter and Little Green Light

DOWNLOAD YOUR COPY

Introduction

Selecting Software as a Service
with Security in Mind

By Kai Dailey

Program Manager and GRC Analyst

501Secure

Introduction

Why Baseline Online Security Shouldn't Be a Luxury for Nonprofits

When you look for a cloud tool to support your team—whether it’s Google Workspace, HubSpot, Little Green Light, or any of the hundreds of platforms built for remote work and productivity—you usually arrive with a specific wish list. You want smooth collaboration, intuitive dashboards, fair pricing, and clear answers during vendor demos about how painful data migration will be.

Security rarely tops that list.

It makes sense why. If you lead a nonprofit, like most leaders, you focus on serving your communities first, which means when it comes to purchasing cloud services, you are evaluating tools from a perspective of utility and affordability. But if your team handles donor records, employee data, or sensitive client files in the cloud, you face the exact same threats large enterprises face. Security features must be factored into the software budget. Yet for small nonprofits foundational safeguards are routinely locked behind unaffordable paywalls or omitted entirely from entry-level license tiers.

The reason for this, in part, is that the software industry has benefitted from consumers who have not historically known what security features to ask for. For decades, software vendors have treated essential security controls as premium add-ons, tucking them away inside expensive enterprise licensing tiers. They reserve these protections for large teams and big corporations because it is big enterprise technology and legal teams that have the leverage to demand them.

When small organizations seek security advice, experts often respond with a laundry list of expensive software subscriptions and specialized hardware. And if an organization has an unlimited budget, that approach might work. Most nonprofits do not. Every dollar and team member hour must deliver real value toward an organization's purpose.

A more realistic security approach requires a sensible balance among three components:

Getting as many baseline online security protections from the online services you purchase as you can afford, particularly in the form of built-in features.
Practical rules defining how work gets done, who has access to what, and how policies are actually enforced to create clear operational governance that encompasses cybersecurity.
Compensating actions, low-tech or no-cost habits, like strict employee separation processes and structured data handling, that reduce risk without requiring expensive new software.

Asking Better Questions Before You Buy

To level the playing field, we built a shareable Essential SaaS Security Features Checklist. It outlines a list of basic security features that should be bundled as standard with any online software service. We know this isn't the case. As a results, every small organization needs to determine which security features they can safely operate in the cloud without and then verify what features are present before buying licenses, signing a contract, or migrating workflows to a new platform.

To demonstrate how everyday tools stack up against these criteria, we also put together:

A breakdown of Google Workspace security features across license tiers, highlighting where key protections drop off.
A direct side-by-side comparison of two widely used nonprofit SaaS platforms, Givebutter and Little Green Light, to show how standard donor databases measure up against our baseline checklist.

Except for advanced enterprise logging and monitoring integrations (SIEM and CASB on our list), nothing on this checklist is optional in today’s internet environment.

The next time you evaluate software or sit down with a sales representative, take this checklist with you. Ask them plainly which of these protections exists right out of the box on their standard plans. Ask them to explain why any missing piece belongs behind a paywall. It is long past time that we demand a baseline of standard security features from software vendors.

If you have questions about reviewing your current tools or building practical safeguards for your team, send us an email. We are here to help.

Further Questions to Consider

What cloud software services do we use?

What data and accounts do we need to protect?

How does the security features of our current software services measure up?

Is it worth it to pay more per license for better security features?

Do we have the time to implement, monitor, and manage more robust (and complex) security features?

Are data and file storage structured so that we can easily limit access by role and keep data restricted to only those who need it?

Are our daily processes compatible with using single sign-on, role-based permissions, and minimum necessary access without breaking everyday workflows?

Introduction

Essential SaaS Security Feature Checklist

By Raymond Osei

GRC Coordinator and Documentation Specialist 501Secure

Introduction

Central Management of User Logins and Account Access

Technical Term: IAM - Identity and Access Management

IAM is the system used to control who can access your organization’s applications and data. It helps make sure employees, contractors, and volunteers only have access to the information they need for their jobs.

Introduction

Rules That Block or Allow Sign-Ins Based on Specific Conditions Like Device or Location

Technical Term: Conditional Access

Conditional access can be device or user policies to add extra security rules before someone can sign in. For example, it can require additional verification if a user is logging in from a new device, unusual location, or outside normal work hours.

Introduction

Option to Give Users Access Based on Their Specific Job Duties

Technical Term: Role-Based Permissions

Role-based permissions allow access to be assigned based on a person’s job responsibilities. This helps prevent staff from seeing or changing information that is not necessary for their role.

Introduction

One Primary Login Account to Access Multiple Separate Tools and Apps

Technical Term: SSO - Single Sign-On

Single Sign-On allows users to access multiple applications with one set of login credentials. This reduces password fatigue and makes it easier for staff to securely access the tools they need. It also affords the ability to rapidly revoke access to data and accounts if user credentials are compromised or an employee separates from the organization.

Introduction

Options to Require a Second Verification Step Beyond a Password for Account Sign-In

Technical Term: MFA - Multi-Factor Authentication

MFA requires users to provide an additional form of verification beyond a password, such as a mobile app notification or security code. This helps protect accounts, even if a password is stolen.

Introduction

Mandatory Security Settings Instead of Just Opt-In Settings

Technical Term: Global Enforcement vs. Self-Selected Setup

This determines whether administrators can require security settings for all users or whether users choose their own security options. Organization-wide enforcement provides more consistent and effective protection. For organizations that must adhere to compliance standards, global security control is essential.

Introduction

Admin Tools to Check Which Users Have Set Up MFA and What Method They've Chosen

Technical Term: Admin MFA Audit Functions

MFA audit functions allow administrators to see which users have enabled MFA and identify accounts that may not meet security requirements. This helps ensure security policies are being followed.

Introduction

Available Methods for the Second Sign-In Step, Such as an Authenticator App, Hardware Key, or Text Code

Technical Term: MFA Options

MFA options are the different ways users can verify their identity, such as authenticator apps, text messages, email codes, or passkeys. More options provide flexibility while supporting different user needs.

Introduction

Backup Steps for Users to Regain Account Access If They Lose Access to Their Second Sign-In Option

Technical Term: MFA Recovery Options

Recovery options help users regain access to their accounts if they lose their phone, security key, or authentication method. Strong recovery processes reduce downtime while maintaining security.

Introduction

Automatically Log User Out After a Set Period of Inactivity You Control

Technical Term: Session Timeout

Session timeout automatically signs users out after a period of inactivity. This helps prevent unauthorized access if a device is left unattended.

Introduction

Control Over How Long a User Stays Signed in Before Being Asked to Re-Enter Their Credentials

Technical Term: Token Duration

Token duration determines how long a user can stay signed in before they must reauthenticate. Shorter durations improve security, while longer durations improve convenience.

Introduction

Automatically Requiring Extra Verification or Blocking Sign-Ins When an Attempt Looks Suspicious

Technical Term: Risk-Based Conditional Access

Risk-based access encompasses external risk signals evaluated in real-time and can use information such as unusual locations, devices, or login behavior to identify potentially suspicious sign-ins. Additional security checks can then be required before access is granted.

Introduction

A One-Click Action to Immediately Log an Account Out Across Every Active Device and App

Technical Term: Suspend All Sessions

This feature allows administrators to immediately sign users out of active sessions. It is useful when responding to a security incident or a compromised account.

Introduction

Records Showing Where, On What Device, and From What Network Connection a User Signed In

Technical Term: Session Device, Location, and IP Information

Administrators can view where users are logged in from and what devices are being used. This information helps identify suspicious or unauthorized access.

Introduction

Requiring a User to Choose a New Password on Their Next Sign-In Technical Term: Forced Password Reset

Administrators can require users to create a new password. This is often used when an account may have been compromised or when security policies change.

Introduction

Access to Historical Account Activity and Sign-In Records and Control Over How Long They Are Kept
Technical Term: Availability of Logs

Logs provide a record of user activity, sign-in attempts, and administrative actions. They help organizations investigate security incidents and demonstrate compliance requirements.

Introduction

Tracking Where and On What Devices an Active Login Credential is Being Used
Technical Term: Token Usage Across Devices and Locations

This control determines whether a login session can continue working when accessed from different devices, locations, or IP addresses. Restricting token reuse can reduce the risk of account misuse. This reduces the risk of stolen tokens being reused to break into accounts.

Introduction

Connecting Saas Account Activity Records to an External Security Log-Monitoring Service
Technical Term: SIEM Integrations

Security Information and Event Management (SIEM) integration capability allows security information from the application to be sent to a central monitoring platform. This helps organizations detect threats and investigate security events more efficiently.

Introduction

Connecting Accounts to a Security Tool That Monitors and Protects SaaS Account Access and Activity
Technical Term: CASB Integrations

Cloud Access Security Broker (CASB) integration capability provides additional visibility and security controls for cloud applications. They help organizations enforce account access, monitor data usage, enforce data protection policies, and reduce cloud-related risks. It offers central access control for what would be shadow IT. It is accomplished by combining a CASB with an enterprise level browser.

Introduction