It seems we can’t find what you’re looking for. Perhaps searching can help.

Microsoft SSPA

Preferred assessor for Microsoft. Trusted advisor for our clients.

We value our long-standing relationship with Microsoft’s SSPA team, and we’ve been recognized for the high-value services we provide to Microsoft suppliers. With a deep understanding of the SSPA Program and Data Protection Requirements, we work alongside your team through the Independent Assessment process — and beyond.

Typical timeline

4–8 weeks

Fees from

$6,500

Let’s talk SSPA

Read the FAQs

Why suppliers call us

We know SSPA.

You know your industry. We know ours. Here is what working with our team looks like in practice.

We translate the requirements.

Microsoft’s SSPA framework and requirements can be confusing. We’ll help you understand the true intentions behind the framework and make sure your compliance efforts are well aligned and of real business value.

We manage the process for you.

Navigating the Aravo portal, updating your supplier profile, understanding your requirements, requesting due-date extensions, communicating with SSPA — that’s a lot to carry alone. You need an SSPA partner. We’re here for you.

Bring us your concerns early.

If you have questions about where you stand against the DPR, start the conversation with us rather than waiting. Our process identifies gaps early, gives you specific recommendations for remediation, and stays with you even after you reach full compliance.

We’re available all year.

The independent assessment letter isn’t the end of the relationship. We’re on call for questions about SSPA, compliance, and data privacy long after your submission is accepted, and we keep a pulse on changing SSPA requirements so you can stay ahead of developments.

Your team

Led by our SSPA practice leader.

You work directly with the people doing the assessment. Maddie Hall leads our SSPA practice and is your primary point of contact from scoping through submission — and for the questions that come up in between.

Maddie Hall

Principal, SSPA Leader

Maddie leads Smith + Howard’s Microsoft SSPA engagements, guiding suppliers through the Aravo portal, Data Protection Requirements, and Independent Assessment. She partners closely with client teams to identify gaps early and build compliance programs that hold up year over year.

Meet Maddie

FAQs

Frequently asked questions.

The questions suppliers ask us first. If yours isn’t here, ask us directly.

Ask our team

How long is the Microsoft SSPA assessment process?

Typically 4–8 weeks, depending on supplier preparedness and the compliance gaps identified during the assessment, but we can complete them in 3 weeks for motivated suppliers.

What is an SSPA Independent Assessment like?

Here’s a look at our hands-on process, start to finish.

Microsoft asks you to complete your Supplier Profile in Aravo.
You submit your Profile and a DPR Self-Attestation.
Based on your profile, Microsoft may require an Independent Assessment.
We work with you to confirm scope and spot early gaps.
We collect key documents and schedule walkthroughs.
We review your materials and may conduct collaborative walkthroughs.
We provide a list of compliance gaps and recommendations for remediation, and support you as needed.
We finalize our inspections and documentation.
We issue the Independent Assessment Letter for your review and submission to Microsoft.
We’re available year-round for questions on SSPA, compliance, AI, and data privacy.

What is the cost of an SSPA assessment?

Assessment costs are client-specific. They take into account the type of data processed (personal and/or confidential), the number of applicable DPR, the complexity of the services you perform for Microsoft, the complexity of your information systems, and the maturity of your data privacy, security, and responsible AI programs.

Sections A:I

From $6,500

Sections A:J

From $10,000

Sections A:K

From $13,500

What if my company doesn’t pass the SSPA assessment?

SSPA assessments aren’t pass/fail. Microsoft will only accept an Independent Assessment letter if the supplier can demonstrate compliance with all applicable DPR. If we identify gaps in any DPR, we’ll help you understand exactly what remediation the assessment requires.

How often is an SSPA Independent Assessment required?

Independent Assessments can be scoped in during new supplier enrollment and annually during Microsoft’s supplier renewal process. An assessment may be required more often if you make changes to your Data Processing Profile in the Aravo portal.

Start a conversation

Let’s talk SSPA.

Whether you’re a first-time or long-time supplier to Microsoft, tell us where you are and we’ll tell you what’s next.

Prefer to talk now?

+1 (404) 874-6244

TALK TO AN EXPERT