Microsoft SSPA

Mandatory Compliance Services for Microsoft Vendors.

The Microsoft Supplier Security and Privacy Assurance Program (SSPA), formerly known as the Vendor Privacy Assurance Program, is a compliance initiative to regulate how the data of a Microsoft employee, customer or vendor is being handled by Microsoft partners and vendors. The Microsoft SSPA groups vendors into one of three categories: Low Business Impact, Moderate Business Impact, and High Business Impact.

360 Advanced Microsoft SSPA services

Our Microsoft SSPA Services

The 360 Advanced team provides assessment, remediation and recommendations, a Letter of Attestation, and a practitioner’s report.

Microsoft SSPA Assessment

Each assessment begins with a scoping session to understand which data protection requirements (DPRs) are relevant for your organization. Next, our cybersecurity professionals will develop a project plan considering how best to minimize the impact on your team’s resources. Finally, we will request evidence so we can compare your policies and procedures to the DPRs.

Remediation and Recommendations

Over the course of our careers, our professionals have had the benefit of working with thousands of companies, so we’ve seen companies fall all over the spectrum with regard to security and privacy compliance and practices. Using this experience, during the assessment process, we will identify any areas requiring remediation and share recommendations for industry best practices.

Letter of Attestation

Organizations that handle “high business impact” data — such as financial transaction or financial profiles data, medical information, or authentication/authorization credentials — will need to submit a Letter of Attestation from an approved third party (a licensed CPA firm like 360 Advanced) in order to remain in compliance.

Practitioner's Report

We can also issue a practitioner’s report which addresses criteria relating to Management, Consent, Collection, Retention, Accessibility, Security, Monitoring, Disclosure, and Quality.

Which category does my organization fall under?

Low Impact

Handling data containing no personal information requires no further action other than the annual completion of the Microsoft Personal Information (MPI) Inventory, a requirement of all Microsoft vendors.

Moderate Impact

Handling data that includes Personally Identifiable Information (PII) such as Name, Address, Email Address, Phone Number, IP Address, Racial Information, Ethnic Information, Political Affiliation, Religious Beliefs, Sexual Orientation, or Physical and/or Mental Health Information would qualify your organization as having a Moderate Business Impact. At this level, a vendor is required to certify with a self-certification within 90 days of the MPI submission.

High Impact

Handling data that includes Authentication Credentials, Cryptographic Keys, Financial Reports, Credit Card Numbers, and Medical Profiles would mean that the organization must adhere to Microsoft Vendor Data Protection Requirements (DPR) and they must submit a Letter of Attestation within 90 days of the MPI submission.


Prev Arrow
Next Arrow

Begin your Microsoft SSPA Assessment today!

Facing compliance, cybersecurity, or privacy challenges? We’re here for you. Fill out the contact form, and within 24 hours, our team will provide the expert guidance you need.

360 Cyber Resources

Explore a wealth of knowledge in our client stories, insightful blogs, cutting-edge white papers, and the latest press releases—your gateway to a repository of expertise and industry insights.