Mitigating SaaS Provider Bankruptcy Risk

CISA By islever Editorial Last updated Sep 7, 2026

Short answer

D Backing up the data processed by the software ensures business continuity and enables rapid migration if the SaaS provider declares bankruptcy.

Question

Which of the following is the BEST way to mitigate the risk of services no longer being available from a bankrupt Software as a Service (SaaS) provider?

Including service level agreements (SLAs) in the contract
Retaining copies of the software for emergency situations
Having a software escrow agreement with a third party
Backing up the data processed by the software Correct Answer

Key Takeaways

Tests cloud risk mitigation by contrasting SaaS architecture limitations with traditional on-premise solutions, where the common trap is choosing software escrow despite customers lacking source code access.

This CISA question tests strategies for maintaining business continuity when a SaaS vendor faces financial failure. While some candidates debate software escrow, experts and community consensus agree that backing up critical data is the most practical and effective mitigation.

Common mistake: Option C (software escrow) is frequently chosen because it works for proprietary on-premise software, but it fails here since SaaS customers never receive or control the underlying application source code.

Expert Analysis

Why the Answer Is Correct

Backing up critical data directly addresses the primary operational risk when a SaaS vendor becomes insolvent. Since SaaS architecture centralizes application hosting, organizations retain responsibility for data protection and portability. Implementing regular backups ensures that essential business records survive service termination, enabling immediate recovery or migration to an alternative platform. This aligns with ISACA’s guidance on cloud data governance and business continuity planning.

Why the Other Options Are Wrong

Service level agreements merely establish performance metrics during active contracts and offer zero legal leverage during insolvency proceedings. Retaining local software copies contradicts the fundamental SaaS model, where applications run exclusively on the provider’s infrastructure. Software escrow agreements require contractual source code release rights, which subscription-based SaaS customers inherently lack. Consequently, these options either misalign with cloud service definitions or fail to address actual data retention needs.

Community Comment Notes

Top-voted discussions highlight that escrow mechanisms apply to proprietary on-premise deployments, not cloud subscriptions. As contributor #2 notes, SaaS licensing grants usage rights rather than source code access, making escrow legally unenforceable. Multiple commenters reinforce that focusing on data portability rather than application ownership reflects real-world cloud risk management. This consensus directly validates why data backup remains the definitive exam answer.

Exam Strategy

Always distinguish between SaaS, PaaS, and IaaS ownership models before selecting risk mitigation options. In SaaS scenarios, focus exclusively on data portability and backup rather than application-level controls like source code escrow.

Frequently Asked Questions

Why isn't software escrow appropriate for SaaS?

Escrow requires sharing source code, which SaaS vendors never provide to subscribers. Customers only license usage rights, making escrow legally and technically unfeasible.

Do SLAs protect against vendor bankruptcy?

No. SLAs define uptime and performance targets during normal operations but cannot enforce service delivery once a company ceases financial existence.

More CISA FAQ →

Community Votes

50%

50% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

root8 👍 1 Answered D

Escrow applies to software that are proprietary to the company, not SaaS apps. You can't really ask Microsoft to put OneDrive on escrow because you have a license to use it!
blehbleh 👍 1 Answered C

This is C. A software escrow agreement ensures that they would still have access to the software and its source code in case the provider goes out of business.
MIMIBAK 👍 1 Answered C

SaaS Escrow ensures customers can access, restore, or rebuild their SaaS applications and data in case of specific pre-agreed circumstances.
SzekelyElek 👍 1 Answered D

I think D, since it is a SaaS service. The software was never ours.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All CISA Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISA Practice Test →

← Back to CISA Study Guide