Part of our Infosec policy requires that we do a SAS 70 review of any high risk third party vendors. I am getting some gap letters and some letters saying that since the SAS 70 is getting phased out they will not be pursuing a new one. Any suggestions with how to deal with this?

Cheech,

Statement on Standards for Attestation Engagements (SSAE) No. 16 is the new service organization reporting standard, effective starting June 15, 2011. SSAE 16 supersedes Statement on Auditing Standards (SAS) No. 70 with the professional guidance on performing the service auditor's examination. SSAE 16 includes service organization control (SOC) reporting framework (SOC 1, 2, 3).

You can find more information from the following sites:
http://www.aicpa.org/InterestAreas/AccountingAndAuditing/Resources/SOC/Pages/SORHome.aspx
http://ssae16.com/

Hope this helps some.

Thanks,
Russ

Thanks so much