01Tenant isolation
Industry guidance for SaaS treats tenant isolation, making sure one customer can never see another’s data, as a foundational requirement, alongside onboarding, identity and metering [1].
02Access control
Broken access control is the top risk in the OWASP Top 10 [2]. Role and permission checks are verified against the OWASP ASVS [3].
References
- [1]SaaS Lens: AWS Well-Architected Framework · Amazon Web Servicesdocs.aws.amazon.com/wellarchitected/latest/saas-lens/saas-lens.html
- [2]OWASP Top 10 · OWASP Foundationowasp.org/www-project-top-ten/
- [3]Application Security Verification Standard (ASVS) · OWASP Foundationowasp.org/www-project-application-security-verification-standard/