This is a hard question to answer because the risks and how you deal with them depend a lot on the vendor, the type of application, its features, the type of bussines, law regulations, and what you are willing (or not willing) to do to deal with the risks.
You can only sit with your client and try to identify the risks based on their mode of operation. The steps to brainstorm should be :
- how do they operate now without the SaaS solution?
- how will they operate with the SaaS solution (what stays the same, what changes)?
- when they are fully dependent on the SaaS solution and you take that away from them all of a sudden (vendor goes bust, internet connection goes down, etc) what will happen? What will you do to keep the business working? What are your fallbacks or plan B? <= thinking about these will help you identify the risks and the mitigation solutions.
The important point to keep in mind is for the store to keep functioning no matter what. If you have to close the store if the SaaS solution is down, then you are in trouble.
Some things to consider, off the top of my head:
- Vendor going bust (can you export your data or you lose it? If it's financial information, for example, and you get an audit some time afterwards, you might be in some big trouble);
- application not accessible (Can the shop still work? Can you process payments? Can you manage inventory? When the application comes back can you input the "off-line" information back into the app or do you now have two places of information to deal with?)
- security (Is the store data secure at the vendor? Who can access it?)
- contract issues (you need to specify service level agreements with penalties if you can't access the app. If they do updates, upgrades, or deploys it should happen at your convenience not smack in the middle of your shop's busiest hours. If you need specific features can the provider build them and customize them for you, or are you stuck with what they give you. If they offer development options how much will that cost? Can the vendor reziliate the contract at will?);
- performance or scaling (is the internet connection fast enough? is the application itself performant? does it support the store's flow at the most busy time of the day? does your application sit together with a bunch of other applications on the same server sharing resources?)
- any other issues identified at point 3 above.
There isn't a checklist to follow to make sure you identify and mitigate risks for a SaaS application. You just need to build the big picture, see where the SaaS is involved, and where the chain can break in the normal flow of operation.
