What SSPA and the DPR actually are
SSPA stands for Supplier Security and Privacy Assurance. It is the program Microsoft uses to hold its suppliers to a consistent set of privacy and security expectations. The program is a partnership between Microsoft Procurement, Corporate External and Legal Affairs (CELA), and Corporate Security.
SSPA delivers those expectations through a document called the Microsoft Supplier Data Protection Requirements, or DPR. The DPR is Microsoft's baseline set of data-processing instructions for suppliers, organized into privacy requirements, security requirements, and a section of AI Systems requirements that applies to suppliers building or operating AI on Microsoft's behalf.
In short: SSPA is the program, and the DPR is the standard you attest to.
Who gets a request, and why
The scope is broad. It covers all suppliers globally that process Personal Data and/or Microsoft Confidential Data, or that use AI Systems, in connection with the work they perform under contract with Microsoft. If your engagement touches any of those, you are in scope.
What determines exactly which requirements you receive is your Data Processing Profile. You control that profile: you select the engagements you want to be eligible to perform, and those selections trigger the corresponding requirements. Your profile is what decides whether you get the full DPR or a subset of it.
Microsoft business groups can only create engagements with you when the data-processing activity matches the approvals your profile has secured. That is why the profile matters: it gates the work.
The 90-day clock
Every enrolled supplier must complete an annual self-attestation of DPR compliance. When Microsoft issues the request, you have 90 days to complete it. The request comes annually, but it can arrive more often if you change your Data Processing Profile mid-year.
If you update your profile during the year, Microsoft issues the corresponding new requirements. Your existing, completed approvals stay valid and continue to apply until the newly issued requirements are completed, so a mid-year change does not immediately knock you offline, but the new tasks still carry their own 90-day deadline.
What compliant and noncompliant status mean for your revenue
SSPA expresses your standing as a status color, and the two that matter are Green and Red.
- You are in good standing and in-scope purchase orders can process normally.
- Newly enrolled suppliers must reach Green before any engagement with Microsoft can begin.
- Miss the 90-day window and your status changes to Red.
- New in-scope purchase orders cannot process until you return to Green.
- Your account is deactivated from Microsoft Accounts Payable systems.
Put plainly: a Red status is a revenue problem, not just a paperwork problem. It stops new in-scope orders and takes you out of the systems that pay you.
Self-attestation versus independent assessment
For most suppliers, SSPA is a self-attestation: you review the applicable DPR requirements and confirm your compliance. If a requirement genuinely does not apply to the goods or services you provide, you can mark it "doesn't apply" with a detailed comment, but the SSPA team reviews those responses, so the comment has to hold up.
Some suppliers face a higher bar. If your Data Processing Role is Subprocessor, you must have an independent assessment conducted annually rather than self-attesting alone. Suppliers on a published Microsoft subprocessor list must likewise provide independent verification of compliance.
Certain profile attributes trigger additional assurances as well: Software as a Service, website hosting, use of subcontractors, or handling payment cards each raise the requirements. SaaS suppliers, for example, may need a valid ISO 27001 certification, and suppliers handling payment card data must show adherence to PCI DSS.
If you would rather not engage an independent assessor where one is applicable, Microsoft accepts certain certifications as alternatives. Two map closely to the DPR:
- ISO 27701 maps to the privacy requirements and ISO 27001 maps to the security requirements of the DPR, and both are accepted as certification alternatives.
- If you are a healthcare provider in the United States or a covered entity, Microsoft accepts a HITRUST report for privacy and security coverage.
A note on SOC 2: it is a useful control framework and it overlaps with much of what the DPR asks for, but Microsoft does not list SOC 2 among its named certification alternatives for SSPA. Treat it as supporting evidence, not as a substitute for the attestation or an accepted assessment.
How to actually get through it
The request is manageable if you approach it deliberately rather than at day 89. A practical order of operations:
- Confirm your Data Processing Profile is accurate. It drives everything you receive. An overstated profile pulls in requirements you do not need; an understated one can block the engagement you are trying to win.
- Read the DPR against your actual operations. Map each requirement to a real control, and identify anything that genuinely doesn't apply so you can comment on it properly.
- Close the gaps before you attest. Self-attestation is a statement of fact. If a control is not in place, put it in place first rather than attesting to something you cannot support.
- Know whether you need an independent assessment. Subprocessor role, a published subprocessor listing, SaaS, subcontractors, or payment cards can move you beyond self-attestation. Plan the timeline accordingly.
- Treat 90 days as a project, not a form. Start early, keep evidence organized, and protect the deadline. Red status has a direct revenue cost.
Where a fractional security leader fits
Most suppliers who receive an SSPA request are not failing on security. They simply do not have a senior person whose job is to translate a framework like the DPR into their environment, decide what applies, and stand behind the attestation. Hiring a full-time security executive for a once-a-year obligation rarely makes sense.
This is the gap a fractional security leader closes. A fixed-scope readiness assessment reviews your environment, maps your controls against the requirements you actually face, and gives you a prioritized action plan, so when you attest, the statement is defensible and the deadline is not a scramble.
Common questions
What is Microsoft SSPA?
SSPA stands for Supplier Security and Privacy Assurance. It is a Microsoft program that delivers Microsoft's baseline data processing requirements to its suppliers through the Microsoft Supplier Data Protection Requirements (DPR).
Who has to comply with SSPA?
All suppliers globally that process Personal Data and/or Microsoft Confidential Data, or that use AI Systems, in connection with their contract with Microsoft must comply with the SSPA program.
How long do I have to complete the SSPA self-attestation?
Enrolled suppliers must complete the DPR self-attestation within 90 days of receiving the request. If the 90-day period is exceeded, the SSPA status changes to Red (noncompliant).
What happens if my SSPA status turns Red?
When a supplier's SSPA status is Red, new in-scope purchase orders cannot process until the status turns Green, and the account is deactivated from Microsoft Accounts Payable systems.
Does self-attestation ever require an independent assessment?
Yes. Suppliers with a Data Processing Role of Subprocessor, and suppliers on a published Microsoft subprocessor list, must provide independent verification of compliance conducted annually rather than relying on self-attestation alone.