SSAE 18 (Statement on Standards for Attestation Engagements No. 18)

SSAE 18 (Statement on Standards for Attestation Engagements No. 18)

Category: Practices
Brand: AICPA
Tags: compliance, enterprise, privacy

Overview

SSAE 18 is a set of attestation and auditing standards issued by the American Institute of Certified Public Accountants (AICPA). It defines a common framework for independent auditors to examine and report on a service organization’s controls related to handling sensitive client data.

It is the foundational standard used for SOC (System and Organization Controls) examinations and reports (SOC 1, SOC 2, SOC 3).

Purpose

• Provide a standardized framework for evaluating and reporting on service organization controls.
• Enhance transparency and trust between service providers and their customers.
• Support business compliance, auditability, and risk management.
• Help organizations demonstrate appropriate controls over:
  • Security
  • Availability
  • Processing integrity
  • Confidentiality
  • Privacy

Features / Scope

• Controls over sensitive data

  • Focuses on how service organizations process, store, and transmit client or customer data.
  • Applicable to environments such as cloud-based services, data centers, and outsourced business processes.

• Foundation for SOC examinations

  • Defines how auditors perform:
    • SOC 1 engagements (controls relevant to financial reporting).
    • SOC 2 engagements (controls over security, availability, processing integrity, confidentiality, privacy).
    • SOC 3 engagements (general-use reports based on SOC 2 criteria, for broad external audiences).

• Report types (Type 1 vs. Type 2)

  • Type 1 report
    • Describes the system and controls.
    • Evaluates the design and implementation of controls as of a specific date (point-in-time snapshot).
  • Type 2 report
    • Describes the system and controls.
    • Evaluates the operating effectiveness of controls over a period of time (typically several months).

• Support for risk, compliance, and assurance needs

  • Demonstrates that a service organization’s controls are independently assessed.
  • Helps user entities meet regulatory, audit, and internal governance requirements.
  • Supports disaster recovery and continuity expectations (e.g., backup and availability of critical data).

• Relevance to time tracking and similar services

  • For services like cloud-based time tracking and attendance systems, SSAE 18-based SOC reporting provides assurance that:
    • Employee time data is securely stored.
    • Data is properly backed up.
    • Services are reliably available.
    • Data handling supports compliance and auditability.

Who It’s For (Typical Users / Applicable Organizations)

SSAE 18 is relevant for service organizations that process, store, or transmit sensitive data on behalf of others, including:

• Financial institutions and their providers

  • Banks, credit unions, insurance companies and their outsourced service providers.
  • Ensures integrity of financial information and protection of customer financial data.

• Healthcare-related organizations and vendors

  • Hospitals, clinics, medical practices, and their service providers.
  • Addresses protection of patient health information (PHI).

• Technology and cloud service providers

  • Cloud platforms, data centers, hosting providers.
  • Software developers and SaaS providers handling customer data.
  • Demonstrates data security and privacy controls.

• Government agencies and contractors

  • Agencies that outsource IT or business processes.
  • Contractors and vendors handling sensitive government information.

• Retail and e‑commerce

  • Organizations processing credit card payments.
  • Retailers storing or transmitting customer data and financial/transaction data.

• Professional services firms

  • Accounting, legal, and consulting firms dealing with sensitive client data.

Essentially, any organization that offers services involving sensitive or regulated data can use SSAE 18-based SOC reports to demonstrate the design and effectiveness of their controls.

Related Standards / Reports

• SOC 1 (under SSAE 18) – Focus on controls relevant to user entities’ financial reporting.
• SOC 2 (under SSAE 18) – Focus on Trust Services Criteria (security, availability, processing integrity, confidentiality, privacy).
• SOC 3 (under SSAE 18) – General-use version of SOC 2 reports for broad external distribution.

Pricing

Not applicable. SSAE 18 is a professional attestation standard, not a commercial product or service with defined pricing plans.