XMission is pleased to announce that it has completed its SSAE 16, type 2 audit certification pertaining to our colocation, Stackable web hosting, network administration, and support services. The audit was conducted by CPA firm A-lign, who specializes in these audits for IT firms. SSAE 16 replaces the previous industry standard, SAS 70 and brings the US closer to the international standard, ISAE 3402.

Why get an SSAE 16 audit?

In recent years, XMission has greatly expanded its focus on business products, including colocation, advanced web hosting (with our Stackable cloud product), email hosting (with Zimbra), and business telephony. As those products matured, it was only a matter of time before we saw the need to get this audit, especially as enterprise clients started to look more closely at XMission as a vendor. While we are a privately held company, and therefore have no Sarbanes Oxley compliancy concerns ourselves, we recognized that compliance sensitive companies often require SSAE 16 certification, which include publicly-traded enterprises, financial firms, and healthcare organizations.

What was required?

In order to complete the audit, XMission management developed rigorous internal control objectives to support first-class data center, hosting and networking management services. You can think of internal controls as the processes by which an organization manages its people and systems. It is how a company conducts business, day to day. These controls should be closely aligned with the entity's goals and objectives. When an outside auditor comes in, they first review the organization's control objectives to determine if they appear to be reasonable and then secondly test their processes and see if the entity reliably meets those objectives. Professing best practices isn't enough; the proof is in the pudding. XMission chose to have a type 2 audit, which requires an organization to prove the operating effectiveness of its internal controls throughout the audit period. Abiding by new requirements under SSAE 16, the report also contains a written assertion from management regarding the systems and a services auditor’s opinion letter.

What does this mean for XMission customers?

An SSAE 16 audit report provides a framework for a service organization to have an outside entity examine their internal controls, which can then be provided to its enterprise clients. Therefore, an SSAE 16 certification assures potential and existing customers that XMission's policies and procedures are sound and that their critical Internet services and data are secure. Colocation and Stackable customers can request a copy of our audit report, which should make it easier for them to pass their own SSAE 16 audit. If anything is missing which could help them with their own audit, or better set them at ease regarding the products they purchase from XMission, we gladly welcome such requests. We have already started to evaluate how we will expand the scope in next year's audit.