Solved

SSAE 16 and Confidentiality

Posted on 2013-11-20
3
293 Views
Last Modified: 2013-11-21
I understand the purpose and scope of an SSAE 16 audit and why a company would want to be accredited with one. However, because the audit report contains such confidential information, many companies (Google comes to mind) refuse to provide it to even their most highly regarded customers. Are they obtaining it just to say that they have it? And in circumstances like this, what's preventing anyone from just claiming they have had one completed (and then making the confidential argument when an inquiry is made)?
0
Comment
Question by:askrenes
  • 2
3 Comments
 
LVL 28

Expert Comment

by:asavener
ID: 39664055
http://www.ssae16.org/faq/does-our-organization-become-ssae-16-qcertifiedq.html

There is no certification awarded or granted upon completing an SSAE 16 attestation engagement.  Rather, the more technically correct wording one may use it that a service auditor has performed an attestation engagement to report on controls at a service organization, which resulted in the issuance of an SSAE 16 Type 1 or SSAE 16 Type 2 report.
0
 

Author Comment

by:askrenes
ID: 39665661
That doesn't exactly answer my questions. What's preventing anyone from just claiming they have had one completed (and then making the confidential argument when an inquiry is made)?
0
 
LVL 28

Accepted Solution

by:
asavener earned 200 total points
ID: 39665706
And I'm suggesting that even if they're telling the truth, and they've had a SSAE 16 report issued, it's unclear whether that actually means anything.

SSAE 16 is designed as an auditor-to-auditor report; it is not designed for consumption by the general public, or even a business' customers.



You stated, "I understand the purpose and scope of an SSAE 16 audit and why a company would want to be accredited with one."

I'm saying there is no accreditation.  It's a report, not a credential.
0

Featured Post

What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

It’s a strangely common occurrence that when you send someone their login details for a system, they can’t get in. This article will help you understand why it happens, and what you can do about it.
Big data transfers via information superhighways require special attention and protection. Learn more about the IT-regulations of the country where your server is located. Analyze cloud providers and their encryption systems for safe data transit. S…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now