Disaster recovery and security are two important elements that need to be considered by SaaS consumers when evaluating potential providers.

Many SaaS vendors do not have a disaster recovery site. Therefore, ask the following queries to your shortlisted vendors: How do you test your disaster recovery procedures? What is your recovery time? How often do you test? Do you have dispersed infrastructure; are your chief site and your disaster recovery site placed in different geographical locations?

You need to be aware that many SaaS providers do not use enterprise-grade infrastructure to deploy SaaS apps. Many solutions have multiple providers. For example, there may be a firewall provider, an Internet provider, and a few others too in the mix. If a problem rears up, there is a lot of finger-pointing. This issue is common with on-premise IT applications. The solution is to minimize the number of vendors so that there is accountability to ensure they take responsibility about performance.

Ask the potential SaaS vendors the following questions about security: Is your firm SAS70 compliant? What security measures are used at your data centers? What security audits and guidelines does your organization follow? Who manages access and identity management, web application firewalls, log file management, and network connectivity?

Needless to say, take your time to research thoroughly and get the answers to the above queries before you invest in an appropriate SaaS product.