SYSTRUST AND WEBTRUST

SYSTRUST AND WEBTRUST




SysTrust and WebTrust are two specific services developed by the AICPA that are based on the Trust Services Principles and Criteria. SysTrust engagements are designed for the provision or advisory services or assurance on the reliability of a system. WebTrust engagements relate to assurance or advisory services on an organization's system related to e-commerce. Only certified public accountants (CPAs) may provide the assurance services of Trust Services that result in the expression of a Trust Services, WebTrust, or SysTrust opinion, and in order to issue SysTrust or WebTrust reports, CPA firms must be licensed by the AICPA.





The following principles and related criteria have been developed by the AICPA/CICA for use by practitioners in the performance of Trust Services engagements such as SysTrust and WebTrust.



♦ Security. The system is protected against unauthorized access (both physical and logical).





♦ Availability. The system is available for operation and use as committed or agreed.



♦ Processing integrity. System processing is complete, accurate, timely, and authorized.



♦ Online privacy. Personal information obtained as a result of e-commerce is collected,

used, disclosed, and retained as committed or agreed.



♦ Confidentiality. Information designated as confidential is protected as committed or

agreed.



Each of these Principles and Criteria are organized and presented in four broad areas:



♦ Policies. The entity has defined and documented its policies relevant to the particular

principle.
♦ Communications. The entity has communicated its defined policies to authorized users.




♦ Procedures. The entity uses procedures to achieve its objectives in accordance with its

defined policies.



♦ Monitoring. The entity monitors the system and takes action to maintain compliance

with its defined policies.