The answer is a resounding and definitive “No!” According to an article I found on Datamation: How Cloud Computing Security Resembles the Financial Meltdown, putting all your faith in a vendor’s claim to be SAS 70 certified is one of the riskiest move you can make on behalf of your company.

“Who’s issuing these certifications?” it asks. “And where’s the money coming from to pay the auditors checking off the list?” The answer is always: the vendors themselves. Which makes sense, right? Who else should pay a third party auditor to cross-examine a vendor’s internal processes but the vendor, as a courtesy, convenience, and assurance to its customers that they have their act together and can be trusted.

The point made in the Datamation article was that it was third party auditors who signed off all those shoddy sub-prime mortgages as AAA-rated assets, and they were paid by the schmoes needing the recommendation. Shady enough for you? It certainly doesn’t inspire the greatest confidence in organizations that likewise pay their auditors, and that’s not entirely fair.

Of course, there is always the option to hire your own auditor instead of relying on the group hired by the company you’re investigating, but not many of us can bear the expense. It ends up being an excellent PR move for vendors to stamp a “SAS 70 Certified” icon on their site with the message: “Your data is safe with us. We’ve been certified.”

Savvy consumers would request tangible proof, a report of some kind that they can hold in their hand, and requesting this report is the first step in doing your proper due diligence. As nice as it would be to take anyone’s word for it when they promise you the world, it’s a luxury that has probably never existed in any bygone era. The reality is you’ve got to do your research, and any company you do business with has to have the history and the list of satisfied clients to back them up and give a little weight to their claims.

In my personal opinion, it should be a good sign if the company you’re thinking of using as your cloud computing provider can say it’s SAS 70 certified and then prove it. Especially if it’s also gone through the trouble to become certifiably PCI Compliant. And then even more especially if it can give you a list of client referrals that can attest to their positive experience with that particular provider. Altogether it means that the company has its head on straight, is up-to-date on current industry standards, and is proactively on top of its game. It will go that extra mile to grant its customers the assurance they need to entrust their data to them, and that in itself is a valuable consideration to have when you’re comparing the top providers.