What type of company required to have a SAS 70? Does it matter if it is publicly traded or privately owned?

There is much on the internet regarding SAS 70 or the SSAE 16 as it is known today. For example:

http://sas70.com/sas70_overview.html

The SSAE 16 has replaced the SAS 70 as the new "standard" since 2011.

http://blog.thehigheredcio.com/2011/09/02/ssae-16-replaces-sas70/

shows the differences

Is this something we are required to obtain from ALL vendors?

We obtain it for all criticla vendors (core processor, technology vendors, etc).

I would look for a SSAE 16 from vendors that store your customer data at their data center site. Examples: Core processing vendor if you have an outsourced relationship. Online banking vendor, website vendor, or any vendor storing your customer or confidential data on their servers at their data center.

You might also request reports from your regulator as they have sometimes completed audits on the "big boys" in the game ie: your data center.