ISAE 3000 (Revised) is the International Standard on Assurance Engagements for reports other than audits or reviews of historical financial information. Service organisations use it to give customers independent assurance over security, privacy, availability and other controls, in Type I (design) or Type II (operating effectiveness) form.
We define the scope and criteria, design and test controls, prepare the system description and arrange the engagement through our partner audit firms, so you have one point of contact from readiness to report.
Who it is for
- Service providers with European, Middle Eastern or Asian customers
- Companies asked for an independent report on security or privacy controls
- Organisations reporting on ESG or other non-financial information
What you gain
- An internationally recognised assurance report
- Can cover security, availability, privacy or other control objectives
- Reuses ISO 27001 and SOC 2 control work
How we get you ready
Scoping
Agree the systems, services and criteria in scope, and whether a Type 1 or Type 2 report fits your customers and timeline.
Readiness assessment
Map existing controls to the criteria, identify gaps and design missing controls with owners and evidence.
Remediation
Put policies, tooling and processes in place, and rehearse evidence collection so it is routine, not a scramble.
Assurance through our audit partners, or yours
We can arrange the assurance engagement with one of our partner audit firms, so you have one point of contact from readiness to report. If you already have an auditor, we work alongside them instead.
Observation period and report
For Type 2, we monitor controls through the observation window and help you respond to exceptions before the report is issued.