CapaSystems’ ISAE FAQ

ISAE stands for International Standard on Assurance Engagements. An ISAE report is prepared by an independent certified auditor who assesses a service provider’s relevant and agreed-upon processes and procedures.

ISAE reports describe how a service provider’s systems and organizational controls operate and how effective they are.

ISAE reports are not mandatory, but they are developed to give customers the assurance they seek from a service provider. The report is prepared after an auditor review.

A service provider that has obtained an ISAE report can demonstrate the reliability of its services. The report serves as a quality seal, showing that an independent auditor has reviewed and assessed that data is handled confidentially, at a high-security level, and that any risks are properly documented and controlled.

At CapaSystems, our customers should be able to trust that there are no additional risks associated with entrusting parts of their business and data to us. Therefore, we are committed to working with a certified auditor to obtain an ISAE 3000 report as part of our ongoing annual compliance and information security efforts.

An ISAE 3000 report can cover any control agreed upon between the service provider and an independent auditor. CapaSystems has chosen to have an external auditor review our handling of customer data in CapaOne. Through the report, we document the effectiveness of our internal processes and controls for data processing, reviewed by an independent auditor, as part of our GDPR work — both internally and in relation to external parties.

ISO 2700X certifications have previously been the standard for information security. However, as the threat landscape changes, it becomes necessary for companies to achieve a broader level of protection. ISO 27001 primarily focuses on the design of controls, while ISO 27002 guides implementation. ISAE reports are based on these ISO controls but also offer the opportunity to test their effectiveness.