Microsoft SSPA

Microsoft SSPA

The Supplier Security and Privacy Assurance (SSPA) and Data Protection Requirement (DPR), formerly known as the Vendor Privacy Assurance Program, represents a crucial initiative by Microsoft to assess and safeguard the data processed by their suppliers/vendors on Microsoft's behalf.

The Purpose of SSPA DPR Assessment

The SSPA DPR assessment is a proactive step taken by Microsoft to ensure that data entrusted to their suppliers is handled with the utmost care. This assessment seeks to guarantee that the data, whether stored, transferred, or processed, remains secure at all times. It serves as a mechanism for Microsoft to verify that their vendors are aligned with Microsoft's robust security and privacy policies, which are rooted in the company's core values.

Annual Data Assessment

Microsoft facilitates this assessment by sharing an annual link with supplier organizations. Through this link, suppliers are required to provide updated information regarding the data they collect, store, or process on behalf of Microsoft. This process ensures that Microsoft maintains a comprehensive understanding of the data flows within its supplier ecosystem.

Classification for Data Impact

To streamline the assessment process, Microsoft has categorized it into three distinct levels based on the type of data handled by the supplier: High, Medium, and Low business impact. This classification helps suppliers align their security and privacy measures with the specific requirements associated with the data they manage, ensuring a more targeted and effective approach.