Microsoft SSPA
Mandatory compliance services for Microsoft vendors.
The Microsoft Supplier Security and Privacy Assurance Program (SSPA), formerly known as the Vendor Privacy Assurance Program, is a compliance initiative to regulate how the data of a Microsoft employee, customer or vendor is being handled by Microsoft partners and vendors. The Microsoft SSPA groups vendors into one of three categories: Low Business Impact, Moderate Business Impact, and High Business Impact.
Take the next stepOur Microsoft SSPA Services
The 360 Advanced team provides assessment, remediation and recommendations, a Letter of Attestation, and a practitioner’s report.
Each assessment begins with a scoping session to understand which data protection requirements (DPRs) are relevant for your organization. Next, our cybersecurity professionals will develop a project plan considering how best to minimize the impact on your team’s resources. Finally, we will request evidence so we can compare your policies and procedures to the DPRs.
Over the course of our careers, our professionals have had the benefit of working with thousands of companies, so we’ve seen companies fall all over the spectrum with regard to security and privacy compliance and practices. Using this experience, during the assessment process, we will identify any areas requiring remediation and share recommendations for industry best practices.
Organizations that handle “high business impact” data — such as financial transaction or financial profiles data, medical information, or authentication/authorization credentials — will need to submit a Letter of Attestation from an approved third party (a licensed CPA firm like 360 Advanced) in order to remain in compliance.
We can also issue a practitioner’s report which addresses criteria relating to Management, Consent, Collection, Retention, Accessibility, Security, Monitoring, Disclosure, and Quality.
Which category does my organization fall under?
Handling data containing no personal information requires no further action other than the annual completion of the Microsoft Personal Information (MPI) Inventory, a requirement of all Microsoft vendors.
Handling data that includes Personally Identifiable Information (PII) such as Name, Address, Email Address, Phone Number, IP Address, Racial Information, Ethnic Information, Political Affiliation, Religious Beliefs, Sexual Orientation, or Physical and/or Mental Health Information would qualify your organization as having a Moderate Business Impact. At this level, a vendor is required to certify with a self-certification within 90 days of the MPI submission.
Handling data that includes Authentication Credentials, Cryptographic Keys, Financial Reports, Credit Card Numbers, and Medical Profiles would mean that the organization must adhere to Microsoft Vendor Data Protection Requirements (DPR) and they must submit a Letter of Attestation within 90 days of the MPI submission.
Begin your Microsoft SSPA Assessment today
Facing compliance, cybersecurity, or privacy challenges? We’re here for you. Fill out the contact form, and within 24 hours, our team will provide the expert guidance you need.
360 Cyber News and Resources
Explore a wealth of knowledge in our client stories, insightful blogs, cutting-edge white papers, and the latest press releases—your gateway to a repository of expertise and industry insights.
