depends on why you have the SAS 70. Are you getting one on a service provider you use? If so, what are the greatest risks they pose to you? If IS plays heavily into the risk and they are relying on their IS, then you need to ask for SAS 70 that covers IS.
If I had more background, perhaps I could be more specific.