What is MVSP (Minimum Viable Secure Product)?

Quick answer

MVSP (Minimum Viable Secure Product) is a deliberately minimal security checklist for B2B software and outsourcing vendors, created by a coalition of large tech buyers (Google among them) tired of hundred-page questionnaires for straightforward vendor decisions. It defines the baseline a company should meet before selling B2B software: a couple dozen controls across business practices, application design, implementation, and operations. Buyers use it as a procurement filter; vendors use it to show baseline credibility fast.

What's on the checklist

The checklist is short by design, and every item is concrete:

Business layer: vulnerability reporting channel, annual penetration testing, incident handling with customer notification commitments, and published subprocessors.
Application design: single sign-on support, HTTPS everywhere, security headers, and sensible password and session handling.
Implementation: protection against the standard web vulnerability classes, dependency patching, and no default credentials.
Operations: MFA internally, encryption of customer data, logging, backups, and offboarding discipline.

If your product can't check these boxes, enterprise security teams reasonably ask why; if it can, MVSP gives smaller vendors a recognized way to say so without a certification budget.

Where MVSP fits in a compliance journey

MVSP is the floor, not the program: it's what you satisfy in your first year selling B2B, before SOC 2 or ISO 27001 become deal requirements. The smart sequencing is to treat it as the first milestone of the same control set: every MVSP item cross-maps forward into the bigger frameworks, so nothing is throwaway work. Buyers who send MVSP-based questionnaires get answers from the same data that will later back your audits; see running MVSP on OptiTech.

Why buyers like it

For low-risk vendor relationships, a completed MVSP profile replaces questionnaire ping-pong: standard questions, comparable answers, no bespoke spreadsheet. Vendors that publish their MVSP posture on a Trust Center shortcut the process entirely.