Let's take a look at attestations for technical and financial reporting.
The Service Organization Control audit framework is designed by the
AICPA organization, American Institute of Certified Public
Accountants, with three primary reports in mind.
The first one called a SOC1 is the report over financial controls.
A SOC2 is over technical controls, and a SOC3 is a summary of a SOC2.
The reports are all very much customer‑oriented so that the customer
can have a set of confidence based on the opinion of the auditor, and
there's at most an annual calendar that passes by for these reports
to be conducted.
A SOC1 report focuses solely on controls at a cloud service
provider that are likely to be relevant to an audit of a
subscriber's financial statements.
In fact,
it is called the internal control over financial reporting,
ICOFR. And these reports are in two flavors.
A Type 1, which is a report of fairness of the presentation of
management's description of the service organization's system and the
suitability of the design of the controls.
So it would be good to think of that as a snapshot, a point in
time, and it's just a presentation of the design.
Whereas, a Type 2 is a report on the fairness of the presentation, which
would not only include the design, but the operating effectiveness. And so
this is usually achieved over a period of time.
A SOC2 contains what are called trust services
principles or trust service criteria.
There are five in number: security, availability,
processing integrity, confidentiality, and privacy.
This is meant to meet a large range of users that need detailed
information and assurance about the controls at a service organization
relevant to the five trust service principles.
It can be, also as in a SOC1, a Type 1,
which is just a point‑in‑time presentation of the design
of the controls or a Type 2, which would be the proof of
effectiveness of the controls.
So this would be over a period of time, many months, in fact,
that observation would take place.
A SOC3 is a summary of a SOC2, often called a SysTrust
security seal from the AICPA organization.
This allows the assertion from the vendors management regarding the
effectiveness of the control, the auditor's opinion, and the vendors
infrastructure and services recognition. And it gives a significant
level of assurance without giving away the details of either a SOC1 or
a SOC2, which would not be published publicly because of the
sensitivity of the data.
Whereas, a SOC3 can be a WebSEAL that the organization uses for public.
There is no sensitive information inside of it.
There's also what's called a SOC for Cybersecurity.
This is the examination of an entity's enterprise‑wide assessment
of their cybersecurity risk management program.
It's done in a holistic way so that the reporting is
communicated based upon relevant information for those who
would want to consume services.
They also have the trust services criteria for management to evaluate the
effectiveness of controls and for attestation services. Next, we'll move
over into the certification environment.