ID,Category,Requirement,MoSCoW,Vendor answer,Plan it requires,Evidence URL,Date checked,Score 0-5,Verdict
IAM-01,Identity and Access,"SSO via SAML or OIDC, SP-initiated and IdP-initiated",Must,,,,,,
IAM-02,Identity and Access,Named plan on which SSO is first available,Must,,,,,,
IAM-03,Identity and Access,"SCIM 2.0 user provisioning, with the plan named",Must,,,,,,
IAM-04,Identity and Access,SCIM group sync mapped to permission groups,Should,,,,,,
IAM-05,Identity and Access,"Automatic deprovisioning on IdP deactivation, with a stated lag",Must,,,,,,
IAM-06,Identity and Access,"MFA enforced at the identity provider, not bypassed",Must,,,,,,
IAM-07,Identity and Access,Configurable session timeout,Should,,,,,,
RBA-01,Access Control,"Viewer, editor, publisher and admin roles",Must,,,,,,
RBA-02,Access Control,"Content-scoped permissions by space, folder or category",Must,,,,,,
RBA-03,Access Control,Content admin separated from system admin,Should,,,,,,
RBA-04,Access Control,Group-based permission assignment,Should,,,,,,
RBA-05,Access Control,Custom roles,Could,,,,,,
LOG-01,Logging and Evidence,"Login, content, permission and admin events all logged",Must,,,,,,
LOG-02,Logging and Evidence,"Published retention period, in writing",Must,,,,,,
LOG-03,Logging and Evidence,"Export or API access to the log, format stated",Must,,,,,,
LOG-04,Logging and Evidence,Logs immutable to tenant admins,Must,,,,,,
LOG-05,Logging and Evidence,Log streaming to a SIEM,Should,,,,,,
ANA-01,Insight,Top search queries reported,Must,,,,,,
ANA-02,Insight,Zero-result searches reported as a distinct metric,Must,,,,,,
ANA-03,Insight,Article views and content performance,Must,,,,,,
ANA-04,Insight,Reader feedback or ratings,Should,,,,,,
ANA-05,Insight,API access to analytics data,Should,,,,,,
AIR-01,AI and Retrieval,AI answers cite the source article with an openable link,Must,,,,,,
AIR-02,AI and Retrieval,"Answers restricted to your content, no undisclosed web fallback",Must,,,,,,
AIR-03,AI and Retrieval,"Customer content excluded from model training, by contract",Must,,,,,,
AIR-04,AI and Retrieval,Declines or hands off when confidence is low,Should,,,,,,
AIR-05,AI and Retrieval,AI answer volume and outcome reported separately,Should,,,,,,
SEC-01,Assurance,"Current SOC 2 Type II report, released under NDA",Must,,,,,,
SEC-02,Assurance,Data residency region available on the plan quoted,Must,,,,,,
SEC-03,Assurance,ISO 27001 certificate with scope and statement of applicability,Should,,,,,,
SEC-04,Assurance,Data processing agreement signed,Must,,,,,,
SEC-05,Assurance,Subprocessor list with change notification,Should,,,,,,
SEC-06,Assurance,Contractual breach notification window,Must,,,,,,
INT-01,Integrations and API,REST API with published reference,Must,,,,,,
INT-02,Integrations and API,Documented rate limits,Must,,,,,,
INT-03,Integrations and API,Webhooks for content and user events,Should,,,,,,
INT-04,Integrations and API,Ticketing integration,Should,,,,,,
INT-05,Integrations and API,Sandbox or test environment,Should,,,,,,
CNT-01,Content and UX,Version history with restore,Must,,,,,,
CNT-02,Content and UX,"Draft, review, publish workflow",Should,,,,,,
CNT-03,Content and UX,"Accessibility conformance, version named",Must,,,,,,
CNT-04,Content and UX,Accessibility conformance report naming the version assessed,Must,,,,,,
CNT-05,Content and UX,Search quality: typo tolerance and synonyms,Must,,,,,,
CNT-06,Content and UX,Localisation and translation workflow,Should,,,,,,
REL-01,Performance and Reliability,Numeric uptime commitment with service credits,Must,,,,,,
REL-02,Performance and Reliability,Public status page and incident history,Should,,,,,,
REL-03,Performance and Reliability,Search latency target,Should,,,,,,
REL-04,Performance and Reliability,Documented incident response process,Must,,,,,,
REL-05,Performance and Reliability,Geographic redundancy,Could,,,,,,

Source,saascrmreview.com/knowledge-base-software-requirements-template/ (verified 2026-09-09)