SSAE 18 (Statement on Standards for Attestation Engagements No. 18)

SSAE 18 mandates that a licensed CPA firm with relevant expertise must conduct an examination of controls using an engagement letter clearly defining scope, boundaries, and reporting objectives.

The auditor must evaluate the design and operating effectiveness of controls through testing methods including observation, inquiry, inspection of evidence, and re-performance of control procedures, requiring direct access to data center facilities, systems, personnel, and historical control documentation covering the specified reporting period.

For SOC 2 Type II reports (the most common for data centers), SSAE 18 requires a minimum six-month period demonstrating sustained control effectiveness, with evidence collected throughout showing consistent operation rather than isolated compliance moments.

Data centers must maintain contemporaneous documentation including logs, tickets, change records, access matrices, and incident reports that establish controls functioned continuously, addressing specific requirements that controls operated throughout the entire reporting period without significant gaps or failures.

Data centers must map their controls to specific Trust Service Criteria categories (Security, Availability, Processing Integrity, Confidentiality, Privacy), with auditors assessing whether controls address defined criteria elements such as threat identification and response, system monitoring, change management authorization, access restriction, and data protection mechanisms.

Each criterion contains specific attributes—for example, Security CC6.1 requires organizations to identify, classify, and manage information assets throughout their lifecycle using defined procedures that data centers must document and demonstrate operationally.

The data center's management must provide a written assertion accepting responsibility for implementing and maintaining effective controls, describing the control environment, risk assessment processes, and management's evaluation of control effectiveness during the reporting period.

This assertion cannot be generic; it must specifically identify the data center's service offerings, user populations served, processing activities performed, and explicit acknowledgment that certain activities fall outside the scope of the examination, with detailed explanation of scope limitations and boundaries.

SSAE 18 requires data centers to conduct documented risk assessments identifying threats relevant to their operations—including cybersecurity threats, natural disasters, resource constraints, and third-party dependencies—then design and implement specific controls addressing identified risks.

The standard requires evidence that this assessment process occurred, was documented, and involved relevant personnel; for data centers, this typically includes security assessments, business continuity planning processes, threat modeling documentation, and formal control design validation against identified risks.

Auditors must obtain and evaluate evidence that controls actually functioned as designed throughout the reporting period, not merely that controls exist in policy documentation.

For data centers, this means auditors test access logs for effectiveness of logical access controls, review incident response records for security control activation, examine change management records for compliance with authorization procedures, and verify disaster recovery test results demonstrating availability controls function as designed under failure conditions.

SSAE 18 requires explicit documentation of what systems, services, locations, and processes fall within the scope of the examination, with particular importance for data centers operating multiple facilities or service lines.

Management and the auditor must jointly determine scope boundaries, and these determinations must be clearly stated in the SOC report; for example, a data center might scope a report to 'managed hosting services' while explicitly excluding 'professional services' or might include only US-based facilities while excluding international operations, with auditors required to test controls only within defined scope.

When data centers rely on third-party subservice organizations (cloud providers for backup, disaster recovery services, connectivity providers, or security monitoring vendors), SSAE 18 requires data center management to determine how subservice organization controls affect the overall control environment and include relevant controls in the scope of examination.

Auditors must assess subservice organization reports (typically their SOC reports) or conduct direct testing, requiring data centers to maintain contracts ensuring subservice organizations provide necessary control documentation and explicitly acknowledging the relationship in the SOC report's management assertion and scope section.