We’ve come a long way since the days of the SAS 70, which did little to actually test the security of a data center or managed service provider. Under a SAS 70, which was designed to test the integrity of financial reporting and not information security, an organization could make up their own set of rules to be audited against. An auditor, usually a CPA sanctioned by the American Institute of CPAs (AICPA), would “test” their client by looking for evidence that they followed each rule.
The SAS 70 is the equivalent of asking students to write their own test questions. If the client failed their own test question, the auditor would mark them as deficient or non-compliant with that section for that testing period.
The saved copy of this article stops there. The rest is on LinkedIn.