A black and white drawing of a rock formation.

As your company grows, solid security infrastructure is necessary to manage the data security implications of today’s business practices. Cloud computing and the ease of outsourcing services that would have previously required costly in-house storage and computing capacities have changed the way companies do business.

This flexibility today enables organizations to nimbly adapt in response to market needs, and to access breakthrough opportunities for growth. Flexibility for companies is partly driven by systems, programs, and third party operations including SSAE 16, SSAE 18, SOC 1, and SOC 2. But as your company grows it is important to know what the differences between SSAE 16 vs SSAE 18 are.

But this level of flexibility — and the risks that come with outsourcing services that require third-party access to customer data and information — also require comparably evolved security standards, and holistic methods of assessing an organization’s approach to managing its security, internally and in regards to how it works with external partners and service providers.

Establishing a holistic security infrastructure as your organization charts its growth path will position you to maintain a strong security posture as your company grows — ensuring that you build and maintain the trust of your customers along the way.

It is of key importance to understand the cybersecurity risks as well as the benefits associated with outsourcing services. The ease and speed with which companies can streamline operations using software tools operating in the cloud has transformed the business landscape.

However, the use of third-party services accessing data in the cloud means that your company has less control over its data, and less knowledge about where that data is traveling. While outsourcing your company’s services streamlines your operations, the responsibility of maintaining the security of customer data remains with your company — no matter where your data goes.

What is SSAE 16?

SSAE 16 stands for Statement on Standards for Attestation Engagements #16. In practice, SSAE is a set of auditing standards established by the AICPA to guide auditors, especially as they prepare SOC 1 reports. It has been largely replaced by SSAE 18, though, which is why SSAE 18 is often preferred when comparing SSAE 16 vs. SSAE 18.

What is SSAE 18?

SSAE 18, or the Statement on Standards for Attestation Agreements #18, was created and enacted in 2017 by the AICPA. It’s a comprehensive auditing standard that integrates most of the AICPA’s previous standards, so while comparisons of SSAE 18 vs. SSAE 16 often recognize that SSAE 18 is newer, it’s more accurate to say that SSAE 18 includes SSAE 16. SSAE 18 is typically used for SOC 2 reports and SOC 3 reports.

Additional SOC 2 resources

SSAE 16 vs. SSAE18 attestations

A black and white drawing of a rock formation.

As your company grows, solid security infrastructure is necessary to manage the data security implications of today’s business practices. Cloud computing and the ease of outsourcing services that would have previously required costly in-house storage and computing capacities have changed the way companies do business.

This flexibility today enables organizations to nimbly adapt in response to market needs, and to access breakthrough opportunities for growth. Flexibility for companies is partly driven by systems, programs, and third party operations including SSAE 16, SSAE 18, SOC 1, and SOC 2. But as your company grows it is important to know what the differences between SSAE 16 vs SSAE 18 are.

But this level of flexibility — and the risks that come with outsourcing services that require third-party access to customer data and information — also require comparably evolved security standards, and holistic methods of assessing an organization’s approach to managing its security, internally and in regards to how it works with external partners and service providers.

Establishing a holistic security infrastructure as your organization charts its growth path will position you to maintain a strong security posture as your company grows — ensuring that you build and maintain the trust of your customers along the way.

It is of key importance to understand the cybersecurity risks as well as the benefits associated with outsourcing services. The ease and speed with which companies can streamline operations using software tools operating in the cloud has transformed the business landscape.

However, the use of third-party services accessing data in the cloud means that your company has less control over its data, and less knowledge about where that data is traveling. While outsourcing your company’s services streamlines your operations, the responsibility of maintaining the security of customer data remains with your company — no matter where your data goes.

What is SSAE 16?

SSAE 16 stands for Statement on Standards for Attestation Engagements #16. In practice, SSAE is a set of auditing standards established by the AICPA to guide auditors, especially as they prepare SOC 1 reports. It has been largely replaced by SSAE 18, though, which is why SSAE 18 is often preferred when comparing SSAE 16 vs. SSAE 18.

What is SSAE 18?

SSAE 18, or the Statement on Standards for Attestation Agreements #18, was created and enacted in 2017 by the AICPA. It’s a comprehensive auditing standard that integrates most of the AICPA’s previous standards, so while comparisons of SSAE 18 vs. SSAE 16 often recognize that SSAE 18 is newer, it’s more accurate to say that SSAE 18 includes SSAE 16. SSAE 18 is typically used for SOC 2 reports and SOC 3 reports.

Explore more SOC 2 articles

Get started with SOC 2

Start your SOC 2 journey with these related resources.

SOC 2

The SOC 2 Compliance Checklist

Achieving SOC 2 compliance proves to your customers that you prioritize protecting their data. In fact, this proof of compliance helps your company to raise capital, sell to larger customers, and rise above the competition.

The SOC 2 Compliance Checklist
The SOC 2 Compliance Checklist
Compliance

Vanta in Action: Compliance Automation

Demonstrating security compliance with a framework like SOC 2, ISO 27001, HIPAA, etc. is not only essential for scaling your business and raising capital, it also builds an important foundation of trust.

Vanta in Action: Compliance Automation
Vanta in Action: Compliance Automation
Compliance

Coffee & Compliance: Streamlining SOC 2 compliance with Vanta and AWS

SOC 2 is a sought-after security framework for growing SaaS companies. It demonstrates your ability to safeguard the privacy and security of your customer data. But achieving it can be time-consuming and expensive.

Coffee & Compliance: Streamlining SOC 2 compliance with Vanta and AWS
Coffee & Compliance: Streamlining SOC 2 compliance with Vanta and AWS

Get compliant and
build trust, fast.

Two wind turbines on a white background.