What is SSAE 18?

SSAE 18 (Statements on Standards for Attestation Engagements No. 18) is an attestation standard developed by the Auditing Standards Board (ASB) of the American Institute of Certified Public Accountants (AICPA). It governs how service organizations report on the controls they have in place to protect customer data. It is commonly used to assure customers that their data handled by service organizations (e.g., cloud providers, SaaS companies, data centers) is secure and reliable. SSAE 18 replaced SSAE 16 and SAS 70 and provides a framework for SOC (Service Organization Control) reports, including SOC 1, SOC 2, and SOC 3.