SECURITY

SAS 70 audit provides an independent verification that Harding and Carbone has a stable control environment.

SAS 70 is an acronym for Statement on Auditing Standard 70; it was developed and is maintained by the AICPA (American Institute of Certified Public Accountants). Specifically, SAS 70 is a "Report on the Processing of Transactions by Service Organizations" where professional standards are set up for a service auditor that audits and assesses internal controls of a service organization. At the end of the audit, the service auditor issues an important report called the "Service Auditor's Report".

SAS 70 is an extremely thorough audit that is used chiefly as an authoritative guidance. In today's market, it is a very helpful and substantial audit that shows transparency to the businesses that Harding and Carbone works with. In addition, it proves that Harding and Carbone has been thoroughly checked and deemed to have satisfactory controls and safeguards either when hosting specific information or processing information such as data belonging to customers that they do business with. The Sarbanes-Oxley Act (Sarbox or Sox) adds importance in implementing SAS 70 as an important resource to show the effectiveness of a service organization's internal controls and data security safeguards.

SAS 70 Reports are an important tool for corporate auditors; it is mostly used when planning financial statements for the organization. Not only does the SAS 70 Report provide important information, but can also off set costs for the organization due to the fact that they will no longer have to send their own auditors to audit the service organization.

• SAS 70 Certification
• Harding and Carbone's website that is linked to its database has passed several audits including an intrusion test by VeriSign.
• Several of the largest banks in the country have audited Harding and Carbone and we have never failed a technology audit.
• Physical and Network policies in place include, but not limited to, restricted and monitored areas, data destruction, tax rate verification, cryptographic keys, and intrusion detection.