(270) 506-5140 CONTACT US
SOC Reports

What To Know About SSAE 18 For Your Vendor Management

Mar 8, 2017 by Aaron Kirkpatrick

We had SAS 70, then SSAE 16... now SSAE 18 will be making an entrance in May of this year. SSAE 18 is a little different, so we’ve outlined some key points for you below to assist with your understanding and preparation for reviewing SOC reports going forward.

Key Points to Know First

Before we dive into what SSAE 18 is all about, it's important to know a few points to base your understanding.

  • SOC 1 and SSAE 16 will no longer be synonymous. SOC 1’s will only be SOC 1’s.
  • The SSAE 18 does not directly replace the SSAE 16. The SSAE 18 is a simplified standard covering many other standards, SSAE 16 was just one. The SSAE 18 causes the SSAE 16 to be retired though as 16 is covered within 18.
  • If you request an SSAE 16/SOC 1 now, you’ll still request a SOC 1, just without reference to SSAE 16 or 18.
  • The SSAE 18 does not affect SOC 2 or 3’s as they are covered under a different standard than the SSAE 16 was.

What is SSAE 18?

SSAE 18 requires a new creation and mandatory inclusion of Complementary Subservice Organization Controls when applicable. This will provide additional clarity of how your vendor is addressing their own vendor management obligations. Therefore, your vendors who use vendors of their own (your fourth parties) now must identify functions and controls that proves your fourth parties are performing.

The purpose for the creation of the SSAE 18 was to clarify the auditing standards and to reduce duplication within similar standards covering Examinations, Reviews and Agreed-Upon Procedure engagements, specifically SSAE Nos. 10-17. These now fall under SSAE 18.

We find this to be an interesting, and much needed, turn of events. Vendor Management is no longer just your problem, it’s also your vendor’s problem.

Our customers who use our SOC Analysis service already know that subservice organizations have been a focus in our analyses and this update will further our ability to provide even more insight into the information security position of your vendors.

Bad News About SSAE 18

The bad news is this does not provide you with any additional assurance as the scope of your vendor’s audit will not include the operating effectiveness of the controls at your vendor’s subservice organization. However, it will provide the guidance you need to perform an informed review of the subservice organization’s SOC 1 or 2 report or other available and comparable documentation. To learn more about these reports, download our Understanding the Differences Between a SOC 1, 2 and 3 infographic

When can you expect to see the new SSAE 18?

As mentioned earlier, SSAE 18 will be effective May 1, 2017 and you will no longer use SSAE 16. Early adoption is available now. By mid to late 2017, you should begin to see the first SSAE 18’s being provided by vendors.

Related Key SOC 1 Updates

A few SOC 1 updates include: 

  • Requirement of Risk Assessments based on control objectives within the SOC
  • Refined Complementary User Entity Controls (CUECs) so that only controls that directly relate back to the product/service in scope of the report are noted
  • Auditors are required to gain further clarification and understanding, although not required to be noted in the report

View our expanded knowledge on SSAE 18 via our infographic.

SSAE 18 and Its Impact to Financial Institutions

Aaron Kirkpatrick

Written by Aaron Kirkpatrick

Aaron is a Certified Information Systems Security Professional (CISSP) who has acquired a wide range of organizational, technical and compliance knowledge, applying it within data center and financial institution services sectors. He’s created and successfully led security, risk and audit programs, including SOC engagements, for data centers and a financial application company, transitioning to Internal Audit at one of the largest financial system providers. He has paired a technical degree in Network Administration and Engineering with a Bachelor’s degree in Management Information Systems. Relevant professional certifications include: Certified Information Systems Security Professional (CISSP), Certified in Risk and Information Systems Control (CRISC), GIAC Certified Incident Handler (GCIH) and GIAC Critical Controls Certification (GCCC). He is a member of ISACA and (ISC)2.

Follow Aaron Kirkpatrick

Subscribe to the Venminder Blog