Data Recovery and SAS 70 Type II Certification
Originally established as a means of controlling and securing financial data, SAS 70 standards were widely used by publicly traded companies until 2010. To earn certification, businesses must commit to strict standards and engage in regular audits to show that they continue to follow the same practices.
There are two types of auditor’s reports associated with SAS 70 standards. Type I reports describe controls at a specific point in time, while Type II reports require ongoing testing over a given period. SAS 70 Type II certification is more appropriate than Type I certification for data recovery companies and other IT service providers.
Requirements and contents of an SAS 70 Type II certification include:
- The auditor’s opinion (often referred to as the Auditor’s Report) of a company’s controls.
- The company’s own descriptions of their security controls.
- Other relevant information from the applying company or organization.
- A testing report provided by an auditor. Includes information regarding the effectiveness of any tests performed on the applicant’s security systems.
In 2010, SAS 70 standards were largely replaced by SSAE 16 standards. These programs are closely related, but SSAE 16 is much more strict and requires attestations rather than simple audits. It is also designed to adapt to new changes in technology and is regarded as a more robust alternative to SAS 70.
To improve the quality of our security systems and to provide customers with the best possible results, Secure Data Recovery Services switched from SAS 70 II standards to SSAE 16 Type II SOC-1 standards in 2013. Visit our SSAE 16 page for more information regarding the differences between these standards or to view our most up-to-date SSAE 16 credentials.