The answer is a resounding and definitive “No!” According to an article I found on Datamation: How Cloud Computing Security Resembles the Financial Meltdown, putting all your faith in a vendor’s claim to be SAS 70 certified is one of the riskiest move you can make on behalf of your company.

“Who’s issuing these certifications?” it asks. “And where’s the money coming from to pay the auditors checking off the list?” The answer is always: the vendors themselves. Which makes sense, right? Who else should pay a third party auditor to cross-examine a vendor’s internal processes but the vendor, as a courtesy, convenience, and assurance to its customers that they have their act together and can be trusted.

The point made in the Datamation article was that it was third party auditors who signed off all those shoddy sub-prime mortgages as AAA-rated assets, and they were paid by the schmoes needing the recommendation. Shady enough for you? It certainly doesn’t inspire the greatest confidence in organizations that likewise pay their auditors, and that’s not entirely fair.

Of course, there is always the option to hire your own auditor instead of relying on the group hired by the company you’re investigating, but not many of us can bear the expense. It ends up being an excellent PR move for vendors to stamp a “SAS 70 Certified” icon on their site with the message: “Your data is safe with us. We’ve been certified.”

Savvy consumers would request tangible proof, a report of some kind that they can hold in their hand, and requesting this report is the first step in doing your proper due diligence. As nice as it would be to take anyone’s word for it when they promise you the world, it’s a luxury that has probably never existed in any bygone era. The reality is you’ve got to do your research, and any company you do business with has to have the history and the list of satisfied clients to back them up and give a little weight to their claims.

In my personal opinion, it should be a good sign if the company you’re thinking of using as your cloud computing provider can say it’s SAS 70 certified and then prove it. Especially if it’s also gone through the trouble to become certifiably PCI Compliant. And then even more especially if it can give you a list of client referrals that can attest to their positive experience with that particular provider. Altogether it means that the company has its head on straight, is up-to-date on current industry standards, and is proactively on top of its game. It will go that extra mile to grant its customers the assurance they need to entrust their data to them, and that in itself is a valuable consideration to have when you’re comparing the top providers.

What if I want more specific guide lines on what to do before getting a SAS 70 Audit?

Groups such as the Information Systems Audit and Control Association (ISACA) and The IT Governance Institute have published many frameworks and guides for information security and auditing. Other standards that companies may be required to adhere to (such as PCI-DSS etc.) may actually have more specific requirements that can easily be used to create policies and procedures that will allow a SAS 70 audit to be performed.

Will my Service Provider’s SAS 70 report expire and does it need to be renewed?

Not really. The report targets auditing of either one point in time (Type I) or a specific time period (Type II) such as a 6 month period of auditing. Therefore a report is valid as long as it was correctly produced. Of course things change and companies procedures and policies and their ability to execute them will change over time as well, so realistically a report is of less and less value the older it is. Any given provider will probably want to–or be required by their customers–to have a new report generated on a yearly basis as it seems reasonable to ensure that policies are up-to-date and followed appropriately.

Wait, there is more than one kind?

Actually there are two types of SAS 70 audit reports, Type I and Type II. Type I is a ‘report on controls placed in operation’. Type II is a ‘report on controls placed in operation and tests of operating effectiveness’. The only difference is the additional testing of the effectiveness of established operations.

A Type I report states the auditor’s opinion on the service provider’s ‘controls’ or policies and procedures at a particular point in time (the time of the audit). Basically it gives a good idea of whether the controls are fairly presented, whether they are well designed to achieve the desired objectives, and whether they were in place at the time of the audit. The Type I report essentially provides a quick snapshot idea of a service provider’s policies and procedures as they are defined by the service provider in question.

A Type II report is similar to a Type I report but expands the scope from a single auditing instance to a longer period of time, such as 6 or 12 months to provide a more complete idea of whether the service provider is really complying with their own policies and procedures on a day to day basis. This kind of report can be much more revelatory to most groups because almost anyone can quickly fake up some compliance efforts for a day while the auditor is in the office.