From what I have read and known, SEC compliance is quite vague. It is best to be addressed in a strong manner, but when it comes to hosting in third-parties, the only way for you to prove their compliance is via audits.
Since there are no concrete rules (ex: "all third parties must be SAS 70 compliant"), what serves as acceptable? Does "SAS 70 Type II" compliance serve as acceptable? If not, what are some recommendations for dealing with third parties?
Since I know stackexchange hates vague questions, what other audits are proof that third parties are "compliant solutions?"