Microsoft’s Supplier Security and Privacy Assurance (SSPA)

The planning phase occurs at least two months in advance of fieldwork in accordance with the timing outlined in the job arrangement letter (JAL) or statement of work (SOW) executed with the client.  Planning includes obtaining the approved Aravo profile and self-assessment, confirming timing of interviews with key points of contact, and deployment of and evidence gathering for the information request list provided via AuditSource 2.0.  Schellman will be available to the client to answer any questions associated with the assessment to ensure both parties are aligned on scope and expectations. 

Schellman will hold a kickoff meeting to start fieldwork.  Fieldwork consists of various testing procedures to evidence the requirements are met. The testing procedures may include one of the following:

• Inquiry of relevant personnel with the requisite knowledge and experience regarding the performance and application of the related requirement
• Observation of the relevant processes or procedures that includes, but is not limited to, witnessing the performance of controls or evidence of control performance with relevant personnel
• Inspection of the relevant audit records that include, but is not limited to, policies, documented procedures, system configurations, or the existence of sampling attributes such as logged events or acknowledgements

Schellman has a no surprises policy and regular contact with the client during fieldwork, allowing clients to be apprised at all times of conformance status.  

Schellman's assessment is focused on creating a deliverable that is clear, concise, and accurate.  The draft report is provided within 2-3 weeks of the last day of fieldwork.  The final deliverable is available within 5 business days of the client approving the draft version.