SSAE 18 is the rulebook a CPA follows, not a report you can hold.

Nobody receives an "SSAE 18" in the post. It is the professional standard that tells a licensed CPA firm how to plan, test and word an attestation. All three SOC report families (1, 2 and 3) are produced under it, so the label describes how the work was done, not which report you got.

Spelled out: The 18th AICPA Statement on Standards for Attestation Engagements.

Vendor questionnaires, contracts and sales decks still say "SSAE 18 audit" as if it named a report. A buyer who accepts that phrase without asking which SOC report, which type and which period may end up with assurance on the wrong thing, such as a SOC 1 on billing controls when the worry was data security. For a service provider, the standard matters because it sets what the examiner must ask of you: a written management assertion, a description of the system, and evidence about any vendors your controls lean on.

A vendor security questionnaire

A box asking whether you hold an "SSAE 18 report". The honest answer names the SOC report, its type and its period.

The independent service auditor's report

The opinion letter states that the examination was performed under the AICPA attestation standards.

A master services agreement

An audit-rights clause may require an annual examination "under SSAE 18 or its successor".

A CPA firm's engagement letter

Names the AT-C sections the work will follow and what management must provide.

SOC 2

A report family. SSAE 18 is the standard the CPA follows while producing that report.

SAS 70

The older auditing standard for service organization reports, replaced first by SSAE 16 and then folded into SSAE 18.

ISO 27001 certification

ISO 27001 work ends in a certificate handed out by an accredited certification body. SSAE 18 work ends in an attestation report written by a CPA firm, with no certificate.

• In contracts and questionnaires, name the report you hold (one of the three SOC kinds) with its type and period, not just the standard.
• When a buyer asks for "SSAE 18", ask which risk they want covered before you send anything.
• Read your CPA firm's engagement letter for the AT-C sections it cites and the assertion you will sign.

• GuideSSAE 18: what the codification didWhy the standards were recodified, and what changed for service organizations.
• GuideThe AICPA attestation standards, mappedHow SSAE 18, the AT-C sections and the SOC suites fit together.

Sources: AICPA SSAE No. 18, Attestation Standards: Clarification and Recodification; AICPA AT-C sections 105, 205 and 320; AICPA SOC suite of services overview.