SysTrust Certified Backup Our online backup system has been examined and SysTrust Certified by the independent accounting firm PriceWaterhouseCoopers.

Sarbanes-Oxley Regulations >

SysTrust is an assurance service developed by the American Institute of Certified Public Accountants (AICPA) and the Canadian Institute of Chartered Accountants (CICA).

SysTrust: Who needs it and why

SysTrust Certification is critical assurance for any CPA, bank, lender or financial institution subject to an audit of their data security system. Failure to meet industry standards, or loss of data due to improper security data procedures, can result in penalties and fines of up to $1000 per infraction (customer).

A SysTrust Certification is designed to offer assurance to a broad audience—management, boards of directors, customers, and business partners—about the information systems that support a business or one of its segments.

In a SysTrust engagement, a CPA performs an examination or audit to evaluate the system’s reliability. A positive SysTrust report attests to the system’s reliability and ability to operate without material error, flaw, or failure during a stated period of time in a specified environment.

SysTrust tests system reliability according to four essential principles:

1. Availability
   The system is available for operation and use at times set forth in service-level agreements.
   Our data centers have over 99.99% avaiability for the past 8 years.
2. Security
   The system is protected against unauthorized physical and logical access.
   Restricted data center access, bank-level encryption, private key.
3. Processing Integrity
   System processing is complete, accurate, timely, and authorized.
   Data is encrypted before it leaves the host, then transferred and stored in encrypted format.
4. Maintainability
   The system can be updated when required in a manner that continues to provide for system availability, security, and integrity.
   Software and data center updates don't interfere with client backups and restores.

Certification process encompasses our general IT infrastructure, including:

• Production data center and network operations
• Server configuration and database administration
• Storage management systems
• Disaster recovery processes
• System monitoring tools and processes
• System security (both logical and physical)
• Change management and common support processes.

Clients would be interested in a systems assurance examination for some of the following reasons:

• Internal and external users can lose access to essential services because of system failures and crashes.
• Systems can be vulnerable to viruses and hackers because of unauthorized system access.
• System failure can result in loss of access to system services or loss of data confidentiality or integrity.
• Negative publicity in the wake of high-profile system failures can undermine customer and investor confidence.

SysTrust standards also include 58 underlying criteria that establish the specific control objectives a system must meet to be considered reliable.

Why SysTrust affects data backup, and SAS#70 does not

SysTrust is a more stringent data security certification standard than SAS#70, and a more applicable compliance standard for online backup solutions.

Contrary to popular misconception, SAS 70 pertains to internal controls and practices within the company or organization to deliver accurate and truthful financial information to its clients, and does not specifically address the backup company that protects their data.

The Sarbanes/Oxley Act of 2002 requires financial institutions to furnish SAS-70 Reports to its customers as a way of assert the level of controls over their financial statements and assertions.

Differences between SAS 70 and SysTrust audit engagements