Erin Mackler
American Institute of Certified Public Accountants
1211 Avenue of the Americas
New York, NY 10036-8775

December 6, 2016

Dear Ms. Mackler:

We appreciate the opportunity to comment on the Proposed Revision of Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (the “proposed trust services criteria”). Companies are trying to design and implement effective cybersecurity risk management programs, as the threat of cybersecurity attacks continues to rise. CPAs are well-positioned to provide value to companies by performing a range of services related to cybersecurity, from advisory services to attestation engagements. Demand for such services is likely to increase, and we note a wider range of stakeholders are interested in reports on companies’ cybersecurity risk management programs.

We continue to support the AICPA’s efforts – both in terms of assistance for companies who wish to report on their cybersecurity risk management programs and guidance for practitioners on how the attestation standards can be applied in this emerging area. The Explanatory Memorandum appropriately identifies many of the issues associated with cybersecurity risk management programs and their evolving nature.

We have offered some overall feedback on cybersecurity risk management programs and the use of the trust services criteria. We have also responded to the specific questions related to the proposed trust services criteria and offer the following suggestions for the Assurance Services Executive Committee’s (ASEC) consideration in finalizing these criteria. We have commented separately on the Proposed Description Criteria for Management’s Description of an Entity’s Cybersecurity Risk Management Program.

We support ASEC’s effort to reorganize and revise the extant trust services criteria to more closely align with the 17 principles in Internal Control—Integrated Framework (COSO 2013 framework) for the reasons set out in the Explanatory Memorandum. We note ASEC’s view that, as revised, the trust services criteria provide a great deal of flexibility in application (e.g., they may be used to evaluate a variety of different subject matters).

We also note the efforts to restructure and add supplemental criteria to better address cybersecurity risks in engagements using the trust services criteria. We believe, if not clearly delineated, that confusion may arise as to how a cybersecurity engagement differs from a SOC 2® engagement when the trust services criteria can be applied to both types of engagements. We believe further articulation of the key differences is necessary for practitioners and those who engage practitioners to perform these types of engagements. This could potentially be done within the practitioner’s report on the cybersecurity engagement, supplemented by additional educational-type materials for those engaging practitioners to perform services related to cybersecurity as well as users of those reports.

We believe the further specificity within the trust services criteria is useful at this time to align with the COSO Framework, as well as to differentiate and align expectations about how a variety of subject matters can be addressed. The trust services criteria were designed to provide flexibility in application and use for a variety of different subject matters, and therefore must remain relatively principles-based. After these proposed changes to the trust services criteria are finalized, we would encourage ASEC to refrain from reopening the criteria to address new or emerging services and instead consider whether other measures could be taken to explain how the trust services criteria can be tailored to those services.

We have not identified any missing supplementary criteria or points of focus at this time.

We do not have any specific concerns about the measurability of any of the supplementary criteria or points of focus, recognizing the role of points of focus (see question 4).

We believe this approach is appropriate. While the points of focus are helpful for both management and practitioners, taking a more prescriptive approach to requiring all points of focus to be addressed in the presentation has the potential to result in more of a "checklist-based" mentality to preparing the presentation and would likely result in onerous narratives that may be less informative. We also suggest ASEC and others give consideration to whether there may be merit in reports issued in accordance with the trust services criteria explaining how points of focus are taken into account, in order to avoid a potential expectation that there would be explicit reporting on each point of focus.

We appreciate the opportunity to express our views and would be pleased to discuss our comments or answer any questions you may have. Please contact Kevin Knight at (703) 918-3505.

Sincerely,