SOC 1 · SOC 2 · SOC 3 guidance
Evidence → Review → Report
Build a practical path to SOC 2
Welcome to the SOC Reporting Guide – The Original SOC 1 / SOC 2 Resource Center
Prepare with your own team, advisory support, software, or a mix, and choose an independent auditor for the examination. Modernize everyday processes, assign evidence owners, and build repeatable routines, with or without new tools.
Compare SOC 1 and SOC 2
Explore the differences between SOC 1 and SOC 2 reports.
Build repeatable processes
Start with the preparation checklist. Assign owners for controls and evidence, and plan work your team can repeat.
Review a vendor
Explore vendor-review questions and reporting terminology.
Choose your support
Discuss your internal resources, advisory needs, and software options with a SOC provider.
The SSAE 18 Audit Standard (Updates and Replaces SSAE-16)
SSAE 18 is a series of enhancements aimed to increase the usefulness and quality of SOC reports, now, superseding SSAE 16, and, obviously the relic of audit reports, SAS 70. The changes made to the standard
Breaking Down SOC 2 CC6.3 Requirements – Controlling Access Control
SOC 2 – CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of
Transition Blueprint: Navigating from SSAE 18 to the New SSAE 22
SSAE 22 was issued a couple years ago, back in December 2020, to supersede AT-C section 210 with three primary changes, apply to both SOC 1 and SOC 2: Description of the procedures a practitioner may
SOC 2 Cheat Sheet
Unlock your understanding of SOC 2 with this cheat sheet by SANS. Ideal for auditors, executives, and sales professionals. Download now
Best Practice Strategies for SOC 2 User Access Reviews
User access reviews are a critical control in almost any IT control framework because they help ensure that users have the appropriate level of access to sensitive data and systems. Without integrity of system access how
SSAE 18 / SOC 1 Type 1 Report – Background Information
A SSAE 18 / SOC 1 Type I Report shows Company’s that your Organization has appropriate controls designed and in place as of the date the report is issued. It does not provide assurance that controls
Why have an SSAE 16 Review Performed?
Some organizations have heard of SAS 70, SSAE 16, and soon to be SSAE 18, but, don’t really know WHY they need to pay to have a bunch of auditors trounce through their company for a
SSAE 18 (SSAE 16) Preparation Tips
This tip is focused on designing controls that reflect the process being testing, if they don’t, a headache of massive proportions will be created once testing begins. What do you do to make sure you don’t
SOC 2 Report – Trust Services Criteria and Categories
The System and Organization Controls (SOC) 2 Report will be performed in accordance with AT-C 205 (formerly under AT-101) and based upon the Trust Services Principles, with the ability to test and report on the design
Get Our Emails
SOC Reporting Guide