Solved

SSAE 16 and Confidentiality

Posted on 2013-11-20
3
320 Views
Last Modified: 2013-11-21
I understand the purpose and scope of an SSAE 16 audit and why a company would want to be accredited with one. However, because the audit report contains such confidential information, many companies (Google comes to mind) refuse to provide it to even their most highly regarded customers. Are they obtaining it just to say that they have it? And in circumstances like this, what's preventing anyone from just claiming they have had one completed (and then making the confidential argument when an inquiry is made)?
0
Comment
Question by:askrenes
  • 2
3 Comments
 
LVL 28

Expert Comment

by:asavener
ID: 39664055
http://www.ssae16.org/faq/does-our-organization-become-ssae-16-qcertifiedq.html

There is no certification awarded or granted upon completing an SSAE 16 attestation engagement.  Rather, the more technically correct wording one may use it that a service auditor has performed an attestation engagement to report on controls at a service organization, which resulted in the issuance of an SSAE 16 Type 1 or SSAE 16 Type 2 report.
0
 

Author Comment

by:askrenes
ID: 39665661
That doesn't exactly answer my questions. What's preventing anyone from just claiming they have had one completed (and then making the confidential argument when an inquiry is made)?
0
 
LVL 28

Accepted Solution

by:
asavener earned 200 total points
ID: 39665706
And I'm suggesting that even if they're telling the truth, and they've had a SSAE 16 report issued, it's unclear whether that actually means anything.

SSAE 16 is designed as an auditor-to-auditor report; it is not designed for consumption by the general public, or even a business' customers.



You stated, "I understand the purpose and scope of an SSAE 16 audit and why a company would want to be accredited with one."

I'm saying there is no accreditation.  It's a report, not a credential.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

One of the biggest threats facing all high-value targets are APT's.  These threats include sophisticated tactics that "often starts with mapping human organization and collecting intelligence on employees, who are nowadays a weaker link than network…
As technology users and professionals, we’re always learning. Our universal interest in advancing our knowledge of the trade is unmatched by most industries. It’s a curiosity that makes sense, given the climate of change. Within that, there lies a…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

831 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question