<div>
<a href="http://www.ssae16.org/faq/does-our-organization-become-ssae-16-qcertifiedq.html" rel="ugc">http://www.ssae16.org/faq/does-our-organization-become-ssae-16-qcertifiedq.html</a><br />
<br />

<blockquote>
There is no certification awarded or granted upon completing an SSAE 16 attestation engagement. &nbsp;Rather, the more technically correct wording one may use it that a service auditor has performed an attestation engagement to report on controls at a service organization, which resulted in the issuance of an SSAE 16 Type 1 or SSAE 16 Type 2 report.
</blockquote>
</div>


http://www.ssae16.org/faq/does-our-organization-become-ssae-16-qcertifiedq.html [http://www.ssae16.org/faq/does-our-organization-become-ssae-16-qcertifiedq.html]



> There is no certification awarded or granted upon completing an SSAE 16 attestation engagement.  Rather, the more technically correct wording one may use it that a service auditor has performed an attestation engagement to report on controls at a service organization, which resulted in the issuance of an SSAE 16 Type 1 or SSAE 16 Type 2 report.

<div>
That doesn't exactly answer my questions. What's preventing anyone from just claiming they have had one completed (and then making the confidential argument when an inquiry is made)?
</div>


That doesn't exactly answer my questions. What's preventing anyone from just claiming they have had one completed (and then making the confidential argument when an inquiry is made)?

<div>
<div class="content wysiwyg-content">
I understand the purpose and scope of an SSAE 16 audit and why a company would want to be accredited with one. However, because the audit report contains such confidential information, many companies (Google comes to mind) refuse to provide it to even their most highly regarded customers. Are they obtaining it just to say that they have it? And in circumstances like this, what's preventing anyone from just claiming they have had one completed (and then making the confidential argument when an inquiry is made)?
</div>
</div>


I understand the purpose and scope of an SSAE 16 audit and why a company would want to be accredited with one. However, because the audit report contains such confidential information, many companies (Google comes to mind) refuse to provide it to even their most highly regarded customers. Are they obtaining it just to say that they have it? And in circumstances like this, what's preventing anyone from just claiming they have had one completed (and then making the confidential argument when an inquiry is made)?

SSAE 16 and Confidentiality

Security is the protection of information systems from theft or damage to the hardware, the software, and the information on them, as well as from disruption or misdirection of the services they provide. The main goal of security is protecting assets, and an asset is anything of value and worthy of protection.  Information Security is a discipline of protecting information assets from threats through safeguards to achieve the objectives of confidentiality, integrity, and availability or CIA for short. On the other hand, disclosure, alteration, and disruption (DAD) compromise the security objectives.

Security

Network security consists of the policies adopted to prevent and monitor authorized access, misuse, modification, or denial of a computer network and network-accessible resources. Network security involves the authorization of access to data in a network, and covers a variety of computer networks; conducting transactions and communications among businesses, government agencies and individuals. Networks can be private, such as within a company, and others which might be open to public access.