SSPA: Supplier Security & Privacy Assurance Program

Yes, every enrolled SSPA supplier account number must be compliant to SSPA when processing Personal Data and/or Microsoft Confidential Data. Each account is managed at the supplier account number level. Hence, the SSPA Program can’t apply compliance across multiple accounts.

If you believe your company has redundant supplier account numbers, please work with Microsoft business owner to determine if those accounts can’t be closed out. Once the determination has been made, please reach out to Microsoft Accounts Payable using the Payment Central tool to close the redundant accounts.

SSPA uses the supplier account number to establish a data processing profile that reflects the activity taking place against the account. To stay SSPA compliant, companies must complete compliance activities including filling out your supplier profile and self-attesting to the Data Protection Requirements (DPR) at least annually.

Suppliers will be able to update their data processing profile at any time during the year if there are no open tasks. When a change is made, the corresponding activity will be issued and must be completed before the approval is secured.

Important: If you start a data processing profile update before the annual renewal, but decide not to make any changes, the system will still execute the corresponding requirements which will need to be completed again.

For more details on the SSPA Process Steps, review the SSPA Annual Process Steps Diagram in the SSPA Program Guide, which is located above.

The Data Protection Requirements (DPR) outline SSPA program privacy and security requirements each supplier must meet to be compliant.

Supplier companies are expected to respond to all applicable requirements presented. Your data processing profile determines whether the full DPR is issued or if a subset of requirements applies. For more details, see the opening paragraph of the Data Protection Requirements.

Download the Data Protection Requirements (DPR) above.

Once the Supplier Profile as been completed, the Authorized Representative* can log onto the Microsoft Supplier Compliance Portal and follow these steps to complete the DPR self-attestation:

1. From the Home tab, select the DPR Attestation hyperlink
2. The Data Protection Requirement Attestation page will be displayed
3. After carefully reading the page, select Next
4. You will need to select a response to each of the presented requirements. An asterisk (*) indicates a Required Field
5. Select a response from the dropdown menu to each DPR requirement until you complete the remainder of the DPR. For additional information regarding comments that may be required, review the first page of the DPR
   • If you select that your company is providing Software as a Service (SaaS) services or that you are processing payment cards on behalf of Microsoft, you will be asked to upload the relevant certifications
   • If you select any responses other than Compliant, you will be presented with a "Responses for Further Review" page to review your comments and selections
6. After completing all the DPR sections and uploading the relevant certifications, if applicable, the "Authorized Representative Attestation" page will be displayed. You will need to input the Name, Title, and Email of the authorized representative who completed the attestation
7. After adding the authorized representative information, select Next
8. The Review & Submit page will be displayed, review the information you provided
9. Select Save & Send Updates to complete the DPR

For step-by-step assistance using the Microsoft Supplier Compliance Portal (MSCP), select Quick Reference Guide from the MSCP Welcome screen.

* An authorized representative is a person within the company that has the appropriate level of authority to sign on behalf of the company and has the requisite knowledge on the subject of privacy and security or has consulted with a subject matter expert prior to providing all responses. In addition, an authorized representative must read and fully understand Microsoft’s Data Protection Requirements.

The request to attest to the Data Protection Requirements (DPR) will be sent from Microsoft@aravo.com.

Avoid missing SSPA related communications, make Microsoft@aravo.com a trusted email address and/or check your junk mail folders.

The payment card industry (PCI) has established standards for companies to follow where credit cards are processed. Suppliers are to comply with these standards when securing this certification. SSPA does not offer advice on how to meet PCI standards.

We ask that you submit the certification that applies and meets PCI requirements. For more details on the purpose of the Payment Card Industry Data Security Standard (PCI DSS) requirement, visit the PCI DSS Certification Requirement section of the SSPA Program Guide located above.

Your company is in scope for the Software as a Service (SaaS) requirement if your company delivers software based on common code used in a one-to-many model on a pay-for-use basis or as a subscription based on use metrics. This is commonly known as Software as a Service (SaaS).

Suppliers that provide Software-as-a-Service to Microsoft and have a functional obligation in their contract to have an ISO27001 certification must provide a valid ISO 27001 certification with functional coverage of the software service managed by the supplier. Please note, SSPA is not expecting the third-party datacenter certification as in the past – we expect the ISO 27001 certification of the software service(s) provided to Microsoft and noted in your contract with Microsoft

The submission must be a file upload, we can’t accept internet links to online documents.

For additional information on the SaaS requirement, visit the SaaS Requirement section of the SSPA Program Guide which can be downloaded above.

Suppliers that process higher risk data may also need to provide independent verification of compliance to the Data Protection Requirements (DPR).

The scope of the assessment engagement is limited to Personal Data and/or Microsoft Confidential Data Processed (e.g., collected, used, retained, or disclosed) as part of the performance per the terms of the supplier’s purchase order, contract, or statement of work with Microsoft.

The scope of the engagement is limited to those business segments and/or geographic locations that Process Personal Data and/or Microsoft Confidential Data. The letter of attestation must include the list of locations included in the assessment.

For more details, visit the Independent Assessment Requirement section of the SSPA Program Guide which can be downloaded above.

Your SSPA data processing profile includes selections considered higher risk to Microsoft. Please review the SSPA Program Guide (located above) which indicates the compliance requirements of different profile combinations so that your company makes an informed decision when setting the profile.

To satisfy the Independent Assessment requirement, select an independent assessor to assess your company’s compliance against the Data Protection Requirements (DPR). The assessor must provide an unqualified letter of attestation to the SSPA. For more details on how to approach this requirement, visit the Independent Assessment Requirement section of the SSPA Program Guide located above.

Yes, if they met our industry requirement. SSPA will accept industry certifications where they provide coverage for the standards contained in the DPR.

Your assessor per that meets the following:

1. Assessors must be affiliated with the International Federation of Accountants (IFAC); or
2. The American Institute of Certified Public Accountants (AICPA), or must possess certifications from other relevant privacy and security organizations, such as the International Association of Privacy Professionals (IAPP) or the Information Systems Audit and Control Association (ISACA).

Note: Each supplier is responsible for paying the assessment cost.

Download a copy of the SSPA Program Guide, DPR, and Preferred Assessors List above.

The document submitted by the supplier to the SSPA program must take the form of an unqualified letter of attestation.

The assessor must use the most current Data Protection Requirements (DPR) which includes the Evidence Required to support each requirement. You will need to provide your approved DPR attestation to the assessor.

In the case of a newly enrolled supplier, the assessor will test the design of the controls.

Download a copy of the SSPA Program Guide, DPR, and Preferred Assessors List above.

Letters of attestation can be rejected for a variety of reasons. The most common reason is when information or scope within the assessment is incomplete. If your letter was rejected, log onto the Microsoft Supplier Compliance Portal, review the audit documentation to address the specific comments from the SSPA team to resolve.

For step-by-step assistance using the Microsoft Supplier Compliance Portal, select Quick Reference Guide from the Welcome screen.

The system will not display the option to upload documentation while an extension is being requested.

To view the option to upload and submit your documentation, follow these steps:

1. Open the Independent Assessment task on the dashboard
2. Change the radio button to the question Do you need to request an extension? from “Yes” to “No”. Then you can view the option to upload your documentations and submit for review.

For step-by-step assistance using the Microsoft Supplier Compliance Portal (MSCP), select Quick Reference Guide from the Welcome screen.

Independent Assessments (and all other compliance actions) must be completed within 90 days of the anniversary date.

Suppliers can request a one-time 90-day extension for the Independent Assessment via the Microsoft Supplier Compliance Portal (MSCP).

Supplier steps to request an extension:

1. Log into the account in the Microsoft Supplier Compliance Portal  
   • Forgot your username or password to the MSCP? Select Need help accessing your account? for assistance
2. Open the Independent Assessment task on the dashboard
3. Answer yes to the question: Do you need to request an extension?
4. Select the Add a new Extension button that appears
5. Enter the requested date and justification into the Reason for Request field
6. Select OK to add the request
7. Select Next
8. Then select Save and Send Updates

Once the above steps are completed a request will be sent to the SSPA Service Desk for review. The task will not appear on the home page during review.

Note: These requests are reviewed on a case-by-case basis and must be completed per account number.

For step-by-step assistance using the Microsoft Supplier Compliance Portal (MSCP), select Quick Reference Guide from the Welcome screen.

Suppliers are a Data Subprocessor when Microsoft is the Data Processor, and the Customer is the Data Controller.

Subprocessors who process restricted and highly protected end-user personal data will need additional compliance requirements like the Independent Assessment (a third-party validation of their DPR). This occurs most often within or supporting Microsoft Enterprise or Commercial products and services or within large organizations like education.

If a privacy or security incident occurs, suppliers must inform Microsoft as detailed in the Data Protection Requirements (DPR).

The incident can be reported by emailing Supplier Incident Report (suppir@microsoft.com).