The Microsoft SSPA reassessment process is the recurring attestation that enrolled suppliers must undergo periodically to ensure that they continue complying with all Microsoft Data Protection Requirements. A supplier is obligated to complete the self-attestation on an annual basis, with a 90-day deadline after the request has been sent. In case of a missed deadline, the company’s SSPA status will turn Red, meaning that the entity is no longer compliant.
Introduction
Microsoft suppliers that process personal or Microsoft Confidential Data are obligated to comply with Microsoft’s Supplier Security and Privacy Assurance (SSPA) program requirements. Microsoft uses the SSPA program to evaluate whether it can rely on a supplier’s ability to handle and protect data appropriately.
The Microsoft SSPA reassessment process is one of the crucial steps in the SSPA compliance program. As per the requirements, suppliers must respond to the tasks related to their scope and provide annual attestation to Microsoft within the due date. Additionally, depending on a supplier’s Data Processing Profile (DPP), there might be extra requirements that should be fulfilled.
Understanding the details of the reassessment cycle, SSPA status, Data Protection Requirements (DPR), and applicable deadlines will help avoid mistakes and stay compliant.
What Is Microsoft SSPA Reassessment and Why Does It Matter?
SSPA reassessment refers to the process where Microsoft suppliers review and demonstrate their adherence to all requirements relevant to the data processing activities that the company undertakes on behalf of Microsoft.
SSPA applies to all suppliers that process Personal Data or Microsoft Confidential Data under their Microsoft contracts. All organizations should follow the requirements based on their DPP and activities performed for Microsoft. A supplier that processes data on a SaaS platform, hosts websites, uses subcontractors, or handles payment cards must adhere to additional assurance obligations.
As part of the reassessment process, a supplier is expected to:
- Consider their DPR requirements during the review
- Assess whether controls are appropriately designed and implemented
- Complete the required self-attestation
- Provide relevant information and evidence
- Note requirements that do not apply to them during the reassessment
- Address additional requirements where needed
- Monitor their compliance status as well
While the objective of the annual reassessment is not to complete a self-attestation questionnaire, it is an opportunity for a supplier to make sure that its controls align with the services that they perform for Microsoft.
How Does the Microsoft SSPA Reassessment Process Actually Work?
Depending on the DPP, the detailed requirements may differ; however, the general reassessment process consists of several key steps:
Receive the Reassessment Request
The process usually starts when a supplier receives the request from Microsoft for reassessment of their compliance with relevant requirements.
As one of the key elements of the SSPA program, suppliers should complete an annual self-attestation to Microsoft. Additionally, in case of changes to their DPP, they also undergo additional reassessment steps.
Review the Data Processing Profile
Before fulfilling any additional requirements and completing the self-attestation, the company should review the DPP to ensure that it reflects their current activity for Microsoft accurately.
In particular, based on the activities included in the DPP, a supplier may have different obligations, including those related to higher-risk processing. For instance, those who provide SaaS, host websites, utilize subcontractors, or process payment instruments must undergo additional assurance obligations.
Review the DPR Requirements
Next, the organization should go through all DPR requirements included in the relevant SSPA scope. Those are the requirements that the company has to implement to ensure that the data processing activities are done securely and in accordance with Microsoft’s expectations.
Reviewing the requirements helps the organization understand what evidence it possesses to demonstrate its compliance with all requirements. In cases when the requirements do not apply to a certain supplier, they can reply to Microsoft stating that the specific requirement does not apply and provide evidence.
Complete the Self-Attestations
The next step is to go through the required self-attestation that relates to the selected DPP. It is important to note that suppliers should design their responses taking into consideration their current practice and policies for all aspects of the assurance scope.
Complete Additional Assurance Activities
Depending on the DPP, the organizations may have additional requirements that must be completed.
For instance, certain higher-risk activities require independent assurance that their controls are designed and operating effectively. Subprocessors must undergo an independent assessment on an annual basis.
Submit the Required Information
Once the supplier has reviewed the request, addressed additional requirements, and completed the self-attestation, the organization has to submit the response via the dedicated SSPA portal.
When completing the submissions, it is important to note that the closer it gets to the due date, the more difficult it may be to obtain the necessary information that supports the attestation statements. Therefore, it is essential to ensure that no required evidence is submitted.
What Is the SSPA 90-Day Deadline – And What Happens If You Miss It?
The SSPA 90-day timeframe refers to the number of days that a supplier has to complete an annual DPR self-attestation after receiving the request from Microsoft.
According to Microsoft’s instructions, all enrolled suppliers must attest to their continued compliance with the requirements in the SSPA, with the 90-day deadline after the request has been received. The same obligation applies if a company modifies its DPP during the year.
Missing the deadline could lead to a supplier’s status turning red, which means that the entity will no longer be compliant with Microsoft’s requirements. The in-scope purchase orders will only be able to resume once the company responds to the request and updates its status to Green.
Therefore, it is essential that the company addresses the request well before the due date to avoid disruptions.
SSPA Green vs Red Status: What Each One Means for Your Compliance
A supplier’s SSPA status indicates whether the entity is compliant with the requirements.
| Status | What It Means | What Suppliers Should Do |
|---|---|---|
| SSPA Green Status | The supplier has satisfied the applicable requirements and is compliant for the relevant approval. | Continue monitoring compliance requirements and maintain the necessary status. |
| SSPA Red Status | The supplier is noncompliant with applicable requirements. | Review outstanding requirements and take corrective action to return to compliance. |
Microsoft Supplier DPR Reassessment: What Suppliers Must Prepare
The Microsoft supplier DPR reassessment centers around the relevant requirements that apply to the approved DPP.
Even though the requirements relate to the organization’s security and privacy controls, not all of them apply to all entities. The requirements depend on the activities that the organization performs for Microsoft.
Before starting the reassessment process, the organization should:
- Go through the current services they offer Microsoft
- Review the data they process
- Check their current DPP
- Assess the applicable DPR requirements
- Examine their security and privacy policies
- Collect the necessary evidence
- Review their prior responses
- Address changes that they have implemented since the last reassessment
This preparation will help make the reassessment process smooth and avoid missing any requirements.
How to Manage the SSPA Annual Compliance Cycle Year-Round
The SSPA annual compliance cycle entails that the company must treat the compliance process as an ongoing endeavor.
As per the Microsoft SSPA Reassessment requirements, all suppliers enrolled in the program must complete an annual DPR self-attestation. Furthermore, depending on the changes to a supplier’s DPP, they might have to respond to additional requests during the year.
A practical way to manage an annual cycle is to follow a particular schedule that will allow the organization to address the reassessment in a timely manner. One of the examples of the annual SSPA compliance cycle is:
- Review current profile
- Identify applicable requirements
- Complete a policy review
- Gather evidence
- Conduct a self-attestation
- Address any outstanding requirements
- Monitor their status
- Prepare for the next review
The better the organization prepares in advance for the reassessment, the faster they will be able to complete it.
Microsoft SSPA Renewal Process: How to Stay Ahead of Reassessment
The Microsoft SSPA Reassessment renewal process should be treated as a part of the organization’s ongoing compliance management. Instead of waiting for the attestation request from Microsoft, the company should be preparing for it throughout the year.
In particular, the organization should update all relevant policies and procedures to ensure that they reflect the current practice. Furthermore, the organization should monitor access controls and ensure that they appropriately secure relevant data. Lastly, it is important to keep all evidence in an organized manner and ensure that nothing is misplaced.
Additionally, the organization should consider if their current DPP still reflects the services they provide Microsoft. Microsoft allows the suppliers to update their DPP if there are no open tasks. However, an additional reassessment will be required, and the evidence must be provided before the updated approvals are granted.
How to Maintain SSPA Compliance All Year (Not Just at Renewal Time)
Understanding how to maintain SSPA compliance is vital, as it ensures that an organization is always prepared. The following best practices will help in maintaining compliance with Microsoft’s requirements:
Maintain Updated Policies
An organization should ensure that their policies are updated and aligned with their current practice. When reviewing policies, the company should consider the following requirements:
- Privacy and information security policies
- Access control policies
- Information security incident lifecycle management
- Records management
- Physical and environmental security
Reviewing these documents will reduce the risk of failure during a control assessment.
Keep Evidence Organized
Organizations should store appropriate evidence in a logical place that allows them to retrieve it faster. It is essential that the evidence is up-to-date and readily available when needed.
Monitor Changes
All changes, including those to services, subcontractors, data processing activities, and other relevant operations must be monitored. These changes may impact the requirements that apply to the organization.
Review Access Controls
A company should regularly review their access controls to ensure that only the appropriate personnel have access to sensitive information. The controls should be updated if there are any unauthorized access attempts.
Track Compliance Deadlines
The company should have a centralized repository that contains all compliance-related deadlines, including the 90-day assessment window. This way, it will be easier to keep track of the due dates and ensure that nothing is missed.
Review the Data Processing Profile
A company must ensure that their DPP always reflects the services they provide Microsoft. If the DPP has not been updated, it has to be done before the next reassessment, even if it requires additional evidence.
What Happens If You Miss SSPA Requirements? (Red Status Risks Explained)
Failing to respond to requests and complete the required assessments on time could lead to detrimental consequences for the organization. For example, per the Microsoft SSPA Reassessment guidelines, the entity’s status will change to Red if they have missed the 90-day deadline for annual reassessment. This also means that no in-scope purchase orders will be fulfilled.
Such consequences emphasize the importance of addressing each request in a timely manner. To avoid such situations, the organization must understand the requirements and prepare well in advance of the due date.
Microsoft SSPA Reassessment Best Practices
The following best practices will help ensure that an organization can handle the reassessment process successfully:
- Start the process right away after the request has been received.
- Set responsible parties for each obligation.
- Store all evidence in one safe place.
- Review the DPP before responding to the DPR requirements.
- Document the rationale behind any requirements that do not apply.
- Track all open items and tasks related to the reassessment.
- Engage security, privacy, legal, and compliance resources when needed.
- Monitor the status of the response and the overall progress.
- Avoid completing independent assessments close to the 90-day deadline.
These best practices will greatly improve the organization’s ability to complete the reassessment in a timely manner.
Frequently Asked Questions
What is the Microsoft SSPA reassessment process?
It is a review that confirms suppliers are meeting Microsoft’s relevant security and privacy requirements.
What does an SSPA red status mean?
It means the supplier has open requirements or compliance issues that need to be resolved.
What is the difference between SSPA green and red status?
Green indicates that applicable requirements have been met, while red means additional action is needed.
How can suppliers maintain compliance?
Suppliers should keep documentation updated, monitor their obligations, complete reviews on time, and address open items promptly.
What is the SSPA 90-day timeframe?
It is the applicable period for completing certain required activities before the deadline.
Conclusion
The Microsoft SSPA reassessment is an important part of meeting applicable security and privacy expectations. Organizations should understand the controls relevant to their Data Processing Profile (DPP) and keep their policies, evidence, and documentation updated throughout the year.
Although the review may take place annually, preparation should be an ongoing process. Regularly checking policies, evidence, and updates can help organizations remain prepared and reduce the risk of an unfavorable status.
Suppliers should also pay close attention to the applicable 90-day timeframe and complete required attestations, evidence submissions, and other activities within the specified period. Maintaining accurate documentation and addressing outstanding items promptly can support continued compliance with Microsoft’s expectations.
Discover more from Diginatives
Subscribe to get the latest posts sent to your email.
