Type I – A report on policies and procedures placed in operation as of a specified point in time. SSAE 18 type I reports evaluate the design effectiveness of a service provider’s controls and then confirms the controls have been placed in operation as of a specific date.
Type II – A report on policies and procedures placed in operation and tests of operating effectiveness for a period of time. SSAE 18 type II reports include the examination and confirmation steps involved in a type I examination plus include an evaluation of the operating effectiveness of the controls for a period of at least six consecutive calendar months. Most user organizations require their service provider to undergo the type II level examination for the greater level of assurance it provides. |