I work in a heavily regulated industry and we cannot even consider a SaaS application until it does nearly all of these things. If an application doesn't have

I work in a heavily regulated industry and we cannot even consider a SaaS application until it does nearly all of these things. If an application doesn't have SAML, SIEM ready audit logs and RBAC it can't even be added to RFP consideration, let alone bid for our business. I have sat through a number of startup SaaS pitches where the product looks interesting and would solve one or more active business problems, but when I ask about roles or audit logs it hasn't even been considered and I cannot consider it any longer. One item lacking from the list is tenant isolation. We don't always require a fully isolated tenant (though we often do if customer data is going to be stored in the cloud), but we do require whatever isolation there is be fully documented and provided. I'm also noticing a trend among SaaS providers to have what they consider strong SLAs we find laughably weak. If your SEV1 SLA is more than 30 minute response time you're not ready to pitch me anything. This isn't beating up on the new guy; our internal business-critical applications all have 15 minute response requirements for the internal support teams.