Typically, 3-6 weeks depending on supplier preparedness and compliance gaps identified during the assessment.
Assessment costs are client-specific and take into consideration factors including the type of data processed (personal and/or confidential), the number of applicable DPR, complexity of services performed for Microsoft, complexity of information systems, and the maturity of your data privacy and security programs.
SSPA assessments are not pass/fail - Microsoft will only accept Independent Assessment letters if the supplier is able to demonstrate compliance with all applicable DPR. If we identify gaps in your compliance with any DPR, we will help you understand the remediation actions required for completion of the assessment.
Independent Assessments are required during new supplier enrollment and annually during Microsoft's annual supplier renewal process. An Assessment may be required more often if changes are made to your Data Processing Profile in Microsoft's Aravo portal.
