Key Takeaways
- Mandatory for Microsoft Ecosystem: Suppliers, partners, and vendors in the Microsoft ecosystem that handle personal or confidential data are required to certify compliance with the Microsoft Supplier Data Protection Requirements (SDPR) under the Supplier Security and Privacy Assurance (SSPA) program.
- Initial Design, Subsequent Effectiveness: For the initial compliance assessment, the focus is on the design of the organization’s controls. In all subsequent, ongoing assessments, the focus shifts to verifying the effectiveness of those implemented controls.
- No Issues Permitted on Submission: The final letter of attestation submitted to the SSPA program must not indicate any issues regarding the supplier meeting the Data Protection Requirements (DPR). All issues must be fully remedied before the letter of attestation is submitted.
Suppliers, partners, and vendors that are part of the Microsoft ecosystem are required to certify compliance with the Microsoft Supplier Data Protection Requirements (SDPR). Also, if your organization is a new Microsoft supplier, these requirements will need to be certified before starting work and on an annual basis thereafter.
What is Microsoft SDPR?
The Supplier Security and Privacy Assurance (SSPA) program covers Microsoft suppliers that work with personal or confidential data. The SSPA covers Microsoft suppliers across the globe on an annual basis. Assessment may be required more often if the scope within which your organization works with Microsoft data changes.
Speak to a Compliance Specialist.
Assessing Your Organization Against the Microsoft SDPR
Your independent assessor must be able to meet the following criteria to certify your organization against the SDPR:
- Your assessor must offer sufficient technical training and subject knowledge in order to appropriately assess compliance.
- Your independent assessor must be affiliated to either the AICPA (like Auditwerx), the IFAC, the ISACA, the IAPP or another relevant security organization.
- Your systems will need to be assessed against the most recent version of the Data Protection Requirements (DPR).
- For your initial assessment, the design of your controls will be assessed. The effectiveness of your controls will be assessed in subsequent assessments.
- The scope of your assessment will need to be limited to the applicable data related to your performance and services.
- Your engagement must be limited to the supplier that receives the request to certify compliance. If there is more than one related supplier account, that information must be reflected in the letter of attestation.
- The letter of attestation submitted to the SSPA must not indicate any issues in relation to the supplier meeting the Data Protection Requirements. Any issues must be remedied ahead of submitting the letter of attestation.
Auditwerx is Your Partner for Microsoft SDPR Assessments
The experienced assessment professionals at Auditwerx are proud to offer Microsoft SDPR certification. This is a natural extension of our comprehensive compliance services. If you are a current Microsoft vendor, or a future partner looking to show your organization’s adherence to the appropriate data requirements, contact Auditwerx today.
FAQs
What is the purpose of the Microsoft SDPR requirement?
The SDPR requires suppliers that work with Microsoft’s personal or confidential data to certify compliance, ensuring data protection under the Supplier Security and Privacy Assurance (SSPA) program.
How frequently must an organization certify its compliance with the SDPR?
Organizations must certify compliance annually, and potentially more often if the scope of the data they handle for Microsoft changes.
What affiliation must an independent security reviewer have to certify against the SDPR?
The independent reviewer must be affiliated with a relevant security organization such as the AICPA, the IFAC, the ISACA, or the IAPP.
What must be fixed before the final letter of attestation is submitted to the SSPA?
Any issues related to the supplier meeting the Data Protection Requirements (DPR) must be fully remedied and corrected before the letter of attestation is submitted.
About the Author
Auditwerx Team
Related Content
Gain Deeper Insights
