We do have our SAS70 and know that SAS70 has nothing to do with real security. It's just controls that an organization sets and gets audited on.

Also, the SAS70 is going away for the SSAE 16. Read more here: http://www.csoonline.com/article/622277/sas-70-replacement-s...