ISAE 3402
Audit standard for outsourcing service providers
TL;DR
ISAE 3402 (International Standard on Assurance Engagements) is required by clients in order to assess outsourcing service providers for their security and control maturity. SOC 1/2 are the US equivalent.
What is ISAE 3402?
Type I (snapshot) vs. Type II (12-month observation):
- Type I: description + control design
- Type II: in addition, effectiveness over 12 months
ISAE 3402 is suitable for NIS2 supplier audits.
Practical example
SaaS provider X offers ISAE 3402 Type II. As a customer you request an annual report — as part of the supplier audit.
Frequently asked questions
Mandatory?
No, but recommended for critical service providers.
Who carries out the audit?
Auditors (Big 4 + mid-sized firms).
See also
Practitioner note: This article is practice-oriented compliance documentation, not legal advice. We are compliance specialists, not a law firm. For legally binding advice, consult an admitted lawyer.