What a SaaS data-export test should include before renewal
Share
Published
A SaaS export test asks whether the information leaving a service can support the work you need to do next. It is more demanding than checking that the export button produces a file.
Use a small sample before renewal or migration. The vendor exit plan explains how the result fits into continuity, access removal and supplier closeout.
Choose records that reveal the awkward cases
Include an ordinary record, a record with an attachment, one with a changed status and one restricted to a particular role. Add a record containing punctuation, non-English characters or a date format that matters to your work.
Use synthetic test records where possible. If a live sample is necessary, obtain the relevant approval and protect it through the test. Do not upload a customer export into an unapproved online converter to discover whether it opens.
Write a test sheet before exporting
| Check | Pass evidence |
|---|---|
| Completeness | Expected sample records and required fields are present |
| Relationships | Attachments and related entries can be matched correctly |
| Meaning | Status codes, dates and field names are documented |
| Access | The receiving process restricts records appropriately |
| Usability | A colleague can complete the intended business task |
| Exceptions | Missing items and manual work have named owners |
Check the files outside the original application
Open them using the approved receiving tool. Check that a readable column heading has not replaced an identifier the next system needs, or that an attachment folder has not lost the connection to its records.
Record the software and settings used for the test. Date interpretation and character handling can depend on the receiving application. A file that appears fine on the administrator’s laptop may behave differently in the intended import process.
Reconcile counts and sample values
Compare the number of records expected with the number received. Then inspect selected values and relationships. A matching count alone would not reveal a customer address placed in the wrong column or a file attached to the wrong order.
Ask how the supplier handles material that is not included in the standard export: attachments, messages, audit history, custom fields or archived items. The answer may vary by service and contract. Document the actual scope rather than assuming every export is complete.
Test the work you need to resume
Have the intended user perform a realistic task with the sample: locate an order, answer a support query or confirm a record’s status. Record where they need the old system to interpret the new files.
For migration, test how a later change will be reconciled. If both systems remain active during a transition, specify who can write to each and how the final difference will be checked.
Keep control of the test copy
An export creates another copy of information. Store it in an approved location, limit access and record what happens to it after the test. A migration exercise should not leave a permanent customer archive in somebody’s downloads folder.
NIST’s small-business quick-start guide is a broader reference for managing business cyber risk. The test sheet here is an original operational method, not an official NIST checklist.
What should go into the renewal decision?
Record the date, sample, observed result, missing material, estimated manual work and person who accepts or resolves each gap. Where the contract is ending, carry those findings into the vendor closeout review. Keep the decision linked to evidence instead of relying on an old claim that “exports are supported.”
Featured image: AI-generated conceptual illustration.
