Microsoft SSPA Independent Assessment
A separate letter on Microsoft’s required template, issued by a qualified independent assessor, for suppliers whose Supplier Security and Privacy Assurance (SSPA) profile requires independent assurance against the Microsoft Data Protection Requirements.
- Criteria
- Microsoft Data Protection Requirements
- Report
- Separate letter on Microsoft’s required template
- Engagement
- Separate non-attest deliverable
Timeline: Aligned to the recipient’s renewal cycle. We tell you on the scope call what is achievable.
Who needs Microsoft SSPA independent assessment?
Suppliers whose SSPA profile requires independent assurance
Only certain data processing profiles trigger an independent assessment. Most suppliers self-attest annually and stop there.
Suppliers who already hold a SOC 2
A SOC 2 Security report can satisfy DPR Section J only. The remaining sections your profile triggers still need the assessment.
SaaS suppliers to Microsoft
Microsoft also requires SaaS suppliers to hold an ISO 27001 certificate from an accredited certification body, which Tang Advisory does not issue.
What is in the deliverable
- A letter on Microsoft’s required template covering the Data Protection Requirements sections your SSPA profile triggers
- Evidence testing coordinated with your SOC 2 where the two overlap, so evidence is requested once
- A clear statement of which DPR sections are covered by the letter and which are satisfied by your SOC 2 Security report (Section J only)
- A note of what the letter does not cover, including the ISO 27001 certificate Microsoft requires of SaaS suppliers
What it is not
Not a SOC 2+ add-on, not an attestation report, not a Microsoft certification or endorsement, and not the ISO 27001 certificate that Microsoft requires of SaaS suppliers. Microsoft decides your supplier status in the SSPA portal.
We do not design, implement, or operate the controls we examine.
How it works
A separate non-attest deliverable on the recipient’s required template, scheduled alongside your SOC 2 where that helps.
- 1
Profile check
Review your SSPA data processing profile and whether it requires independent assurance at all.
- 2
Self-attestation
You complete the annual self-attestation in the portal. Most suppliers stop here.
- 3
Assessment
We test the DPR sections your profile requires and issue the letter on Microsoft’s template.
- 4
Submission
You upload the letter, and your SOC 2 Security report for Section J, to the SSPA portal.
Scope, timing and fees
The deliverable is scoped separately from your SOC 2 during the preliminary scope discussion. Formal scope, timing, and fees are established only after the firm completes its required acceptance and quality gates.
We do not design, implement, or operate the controls we examine.
Frequently asked questions
Microsoft asking for an independent assessment?
Schedule a free 30-minute preliminary scope discussion. We will read your SSPA profile with you and tell you whether independent assurance is required and which sections it covers.