Yes, Public Cloud MSPs Can Be Certified and Audited

We get this question a lot: "I am a managed service provider and I resell or leverage public cloud services...can I be certified?" At the heart of this question is the issue of whether managed service providers who deal with public cloud are somehow less legitimate than other service providers. I'd like to address this issue.

The easy answer to this question is yes; MSPs who leverage public can be certified and audited. When going through any of the UCS levels of audit (including a full SSAE 16 audit), MSPs must disclose the types of technologies they use, including any third party service providers. This means, if you use Amazon Web Services (AWS) to store customer backup data, that will be mentioned in the report. Now, the UCS or SSAE 16 audit may disclose your use of a third party solution like AWS, but it does not mean that our auditors would be able to provide your customers (the readers of the report) with visibility or guidance into how that data is being stored.

For example, such a report might state that the MSP uses backup technology to store data within the AWS cloud. The report would not go into detail on how Amazon accesses that data, whether it is secure, or whether it is always accessible (as some customers might demand). The report would only state that the data resides in the Amazon cloud. Everything leading up to the data resting within Amazon would, however, be disclosed and tested within the audit process.

This process is useful for telling customers how and where their data is being stored and managed. For the MSP, it is helpful to simplify this often complex process for the customer so they can understand exactly what the MSP is responsible for and would fall outside the managed services relationship.

You may be wondering whether a customer would care if their data is in the public cloud. Honestly, the answer depends on the customer and the service they are buying. MSPs who primarily leverage public cloud, while capable of being UCS & SSAE 16 audited/certified may find it difficult selling their services to certain types of customers. Banks, credit unions, hospitals, health care providers, insurance companies, public companies, and any regulated company might raise an objection to their data being exposed to public cloud.