Generated by All in One SEO v4.9.5.1, this is an llms.txt file, used by LLMs to index the site.

# SOC Reporting Guide - SOC 1 | SOC 2

The Original SOC Report Resource Center | SOC 1 | SOC 2 | SOC 3 | SSAE 18 | SSAE 21 Guidance, Tools, Templates. Connect with service providers to facilitate the compliance journey.

## Sitemaps

- [XML Sitemap](https://ssae-16.com/sitemap.xml): Contains all public & indexable URLs for this website.

## Posts

- [SOC 2 Cheat Sheet](https://ssae-16.com/soc-2/soc-2-cheat-sheet/) - Unlock your understanding of SOC 2 with this cheat sheet by SANS. Ideal for auditors, executives, and sales professionals. Download now
- [Firewall Controls in SOC 1 and 2: A Practical Example](https://ssae-16.com/ssae-16/example-ssae-16-controls-firewall/) - Understanding the nuances of firewall controls in SOC 2 and their importance to maintaining appropriate security within a business.
- [The SSAE 18 Audit Standard (Updates and Replaces SSAE-16)](https://ssae-16.com/ssae-16/the-ssae-18-audit-standard/) - SSAE 18 is a series of enhancements aimed to increase the usefulness and quality of SOC reports, now, superseding SSAE 16, and, obviously the relic of audit reports, SAS 70. The changes made to the standard this time around will require companies to take more control and ownership of their own internal controls around the
- [Breaking Down SOC 2 CC6.3 Requirements - Controlling Access Control](https://ssae-16.com/soc-2/soc-2-cc6-3-how-to-meet-the-requirements/) - A practical, step-by-step guide to meeting the requirements of SOC 2's Common Criteria 6.3, Access Control
- [SOC 1 and SOC 2: A Comparative Analysis](https://ssae-16.com/soc-1/why-perform-an-ssae-18-soc-1-or-soc-2-report/) - Compare SOC 1 and SOC 2 frameworks to understand their differences and identify which is most suitable for your organization.
- [Best Practice Strategies for SOC 2 User Access Reviews](https://ssae-16.com/resources/user-access-reviews-2/) - Gain insights into best practices for conducting user access reviews, a crucial component to managing access in your environment.
- [Transition Blueprint: Navigating from SSAE 18 to the New SSAE 22](https://ssae-16.com/ssae-22/ssae-22-supersedes-ssae-18-as-of-june-15-2022/) - Learn the key updates and changes as SSAE 18 is superseded by SSAE 22, effective June 15, 2022, developed to supersede AT-C section 210
- [SSAE 16 vs ISAE 3402 - Part 1](https://ssae-16.com/ssae-16/ssae-16-vs-isae-3402-part-1/) - SSAE 16 and ISAE 3402 are two widely used auditing standards for service organizations. Many assume SSAE 16 is just the U.S. version of the international ISAE 3402
- [SSAE 18 / SOC 1 Type 1 Report - Background Information](https://ssae-16.com/ssae-16-type-i/ssae-18-soc-1-type-1-report-background-information/) - A SSAE 18 / SOC 1 Type I Report shows Company's that your Organization has appropriate controls designed and in place as of the date the report is issued. It does not provide assurance that controls are executed consistently, which, is the purpose of the Type 2 report and what most Company's are hoping to
- [Why have an SSAE 16 Review Performed?](https://ssae-16.com/ssae-18/why-have-an-ssae-16-review-performed/) - Some organizations have heard of SAS 70, SSAE 16, and soon to be SSAE 18, but, don’t really know WHY they need to pay to have a bunch of auditors trounce through their company for a month or two during the year, especially right after their financial audit just finished. The answer is simple: Many
- [SSAE 18 (SSAE 16) Preparation Tips](https://ssae-16.com/soc-1/ssae-16-preparation-tips/) - This tip is focused on designing controls that reflect the process being testing, if they don't, a headache of massive proportions will be created once testing begins. What do you do to make sure you don't screw this up? Have as many meetings as it takes to get it right. What you need to do
- [SOC 2 Report - Trust Services Criteria and Categories](https://ssae-16.com/soc-2/soc-2-report-trust-services-principles/) - The System and Organization Controls (SOC) 2 Report will be performed in accordance with AT-C 205 (formerly under AT-101) and based upon the Trust Services Principles, with the ability to test and report on the design (Type I) and operating (Type II) effectiveness of a service organization's controls (just like SOC 1 / SSAE 18).
- [SSAE 16, The New Standard](https://ssae-16.com/ssae-16/ssae-16-the-new-standard/) - So you have been performing a SAS 70 for the last couple years, or, are getting ready prepared to embark on your first SAS 70, and all of a sudden you hear that a brand new standard has been issued! Don't worry about it! SSAE 16 is an improvement to the current standard for Reporting
- [SOC 1 Report](https://ssae-16.com/soc-1/soc-1-report/) - A SOC 1 Report (System and Organization Controls Report) is a report on Controls at a Service Organization which are relevant to user entities’ internal control over financial reporting. The SOC1 Report is what you would have previously considered to be the standard SAS70, complete with a Type I and Type II reports, but falls
- [SSAE 16 Type I Report Background Information](https://ssae-16.com/ssae-16/ssae-16-type-i-report-background-information/) - There are significant differences between a Type I and Type II report, however, we aren't going to discuss that here, thats for another day. We will discuss the basics of a SSAE 16 Type I Report and some areas that should be focused on if this is the direction your company wants to take. While
- [What does Management Need to Provide the Auditors?](https://ssae-16.com/ssae-18/what-does-management-need-to-provide-the-auditors-with/) - If you have never been audited before, as is the case with many service organizations, you are probably wondering what kind of documentation will I need to give the auditors? What will they do with it once they have it? A high level explanation per the SSAE 16 Guidance: (1) access to all information, such
- [SSAE 16 vs ISAE 3402 - Part 2 - Intentional Acts](https://ssae-16.com/ssae-16/ssae-16-vs-isae-3402-part-2-intentional-acts/) - The first difference between the SSAE 16 and ISAE 3402 Standards is that SSAE 16 requires the service auditor to assess the risk associated with potential “Intentional Acts by Service Organization Personnel”. Under SSAE 16, If the service auditor, while performing their review, notices deviations that could have been a result of an intentional act
- [SSAE 16 Terminology - Criteria](https://ssae-16.com/sae-16-terminology/criteria/) - Criteria, as defined by the SSAE 18 (formerly SSAE 16) guidance are: The standards or benchmarks used to measure and present the subject matter and against which the service auditor evaluates the subject matter. Criteria are the overarching goals that the control objectives and activities that are in place are designed to meet and that
- [SSAE 16 Terminology - Controls at a Service Organization](https://ssae-16.com/controls/ssae-16-terminology-controls-at-a-service-organization/) - Controls at a Service Organization refer to the controls that are in place at your company. Many of these controls should be covered within your policies and procedures, as they should reflect an accurate depiction of the various processes that occur within your organization. Accurate policies and procedures (P&P) should be designed, implemented, and documented
- [SSAE 16 Terminology - Carve-out Method](https://ssae-16.com/sae-16-terminology/ssae-16-terminology-carve-out-method/) - When performing a SSAE 16 Review, you will be inundated with various terms that you may have never heard of before. We plan on continuing with a serious of posts dedicated to explaining the various terminology that you should be aware of to ensure when the auditors are explaining things to you, you don't lost
- [SOC 3 Report - WebTrust and SysTrust](https://ssae-16.com/soc-3/soc-3-report-webtrust-and-systrust/) - The SOC 3 Report , just like SOC 2, is based upon the Trust Service Principles and performed under AT101, the difference being that a SOC 3 Report can be freely distributed (general use) and only reports on if the entity has achieved the Trust Services criteria or not (no description of tests and results
- [SSAE 16 and the Federal HealthCare Exchange](https://ssae-16.com/ssae-16/ssae-16-and-the-federal-healthcare-exchange/) - With the issues surrounding HealthCare.gov and the various contractors who played a role in the development, one question that comes to mind is: How many of the over 50 companies contracted had an SSAE 16 (SOC 1) audit performed over the services they were providing? This is important to know and could be part of
- [The SSAE16 Auditing Standard](https://ssae-16.com/ssae-18/the-ssae16-auditing-standard/) - SSAE 16 is an enhancement to the current standard for Reporting on Controls at a Service Organization, the SAS70. The changes made to the standard will bring your company, and the rest of the companies in the US, up to date with new international service organization reporting standards, the ISAE 3402. The adjustments made from
- [Are Service Provider Contract Updates Needed with SSAE 18?](https://ssae-16.com/ssae-18/are-service-provider-contract-updates-needed-with-ssae-18/) - While some companies still request a SAS 70 report (why, who knows...), many contracts now require a SSAE 16 report, and with the change to SSAE 18 many are now asking, what is the right language to use going forward? To fix this, the AICPA is now stating the standard number or reference should no
- [SOC 1 & SOC 2 Preparation Checklist](https://ssae-16.com/soc-1/ssae-16-preparation-checklist/) - I’ve been hearing from various people in the marketplace that they were interested in learning about some steps, at a high level, that they need to take to get off the ground and on their way to completing their SOC 1/2 Report Type I or Type II. So, I will give you all a breakdown of

## Pages

- [SOC Reporting Guide - SOC 1 | SOC 2 | SOC 3](https://ssae-16.com/) - The SOC Report Resource Center | Guidance, Tools, Templates | Service Provider Identification and Selection | SOC 1 | SOC 2 | SSAE 18 / 21 / 22
- [Contact a SOC 1 /2 Consultant Now](https://ssae-16.com/contact-a-soc-provider-now/) - Selecting a knowledgeable SOC 1 / SOC 2 consultant is critical to success, we help identify the best solution for your organization.
- [SOC 2 Report - Audit / Compliance Hub](https://ssae-16.com/soc-2/) - Prepare for SOC 2 with confidence. Dive into our beginner-friendly guide, get expert help, and confidently prepare for your SOC 2 journey.
- [Vulnerability Assessment and Penetration Testing](https://ssae-16.com/vulnerability-assessment-and-penetration-testing/) - Why is it important and how regular testing can benefit your company?As business has transformed over the years to a more service-oriented environment, a significant increase in trust has been placed on outside organizations to manage business processes and corporate data. Do you truly know how secure your third party service providers networks and /
- [Download the SSAE 18 / SOC Reporting Guide](https://ssae-16.com/download-the-ssae-18-soc-reporting-guide/) - We can help assess your compliance requirements and supporting ecosystem (tooling, consultants, etc.) through a simple intake process to then pair you with the right mix of solution providers, cutting down the time and effort wasted in procurement. Complete the form below to the best of your abilities and someone will be in touch to
- [SOC 1 Report - Audit / Compliance Hub](https://ssae-16.com/soc-1/) - A SOC 1 Report (System and Organization Controls Report) is a report on Controls at a Service Organization which are relevant to user entities’ internal control over financial reporting. The SOC1 Report is what you would have previously considered to be the standard SAS70 (or SSAE 16), complete with a Type I and Type II reports,
- [Frequently Asked Questions](https://ssae-16.com/faqs/) - SSAE-18 FAQ Are Representation Letters Required in SSAE 18? How many updates to SOC 1 have their been? When is SSAE-18 Effective? What is SSAE 18 (formerly SSAE 16)? Are Third Party Vendor reviews required for SOC 1 and SOC 2? SSAE 18 FAQ / Complete List SOC 1 FAQ SOC1 vs SOC2: Differences? How
- [Where to Begin](https://ssae-16.com/where-to-begin/)
- [SSAE Report Frequently Asked Questions](https://ssae-16.com/faqs2/) - SSAE 16 and SSAE 18 Audits bring tons of questions. In this section we hope to answer some questions we frequently come across during our calls and client interactions. [qa]
- [Guides and Documents](https://ssae-16.com/resources/guides-and-documents/) - Here will become a collection of resource documents and links for those looking for more SOC 1 / SOC 2 related help.
- [Tools, Tips and Tricks](https://ssae-16.com/resources/tools-tip-and-tricks/) - Here you will find a collection of Tools, Tips, and Tricks to reduce unnecessary overhead for all involved in the process.
- [Job Openings](https://ssae-16.com/resources/job-openings/) - Here we will highlight job roles we find across the internet, and eventually sourced through Partner firms, word of mouth submissions, and other means. Please submit a job if you think we should highlight it.
- [Resources](https://ssae-16.com/resources/) - Here you will find a collection of resources applicable to everyone in the industry or even looking to get into the industry.
- [SOC 1 & SOC 2 Preparation Checklist](https://ssae-16.com/soc-1-soc-2-preparation-checklist/) - SOC 1 & SOC 2 Preparation Checklist I’ve been hearing from various people in the marketplace that they were interested in learning about some steps, at a high level, that they need to take to get off the ground and on their way to completing their SOC 1/2 Report Type I or Type II. So, I
- [SOC 2 - Trust Services Categories](https://ssae-16.com/soc-2/soc-2-trust-services-categories/) - The SOC 2 criteria are comprised of 5 categories (formerly the SOC 2 principles), security, availability, confidentiality, processing integrity, and privacy, with the common criteria also encompassing security. Each category has a specific set of criteria to meet with corresponding points of focus: Security. Information and systems are protected against unauthorized access, unauthorized disclosure of
- [SOC 2 - Changes Effective December 2018](https://ssae-16.com/soc-2/soc-2-changes-effective-december-2018/) - SOC 2 has been updated to meet the needs of a wider-range of Organizations, improve the overall quality and usefulness of the report, and to assist in reporting at an entity-level, rather than for a specific process or system. These updates will also bring a large number of decisions, changes, and enhanced responsibility and accountability
- [Thank You](https://ssae-16.com/what-you-need-to-know-about-saas-compliance-ssae-16-soc-1-soc-2/thank-you/) - Thank You for your inquiry regarding SaaS ComplianceYou should receive an e-mail to confirm your submission shortly and expect a follow up call within 48 hours to further assist you in your efforts. In the mean time, signup for our Mailing List below to receive guidance, white papers, audit tools, and other useful information monthly.
- [SOC 3 Report - WebTrust and SysTrust](https://ssae-16.com/soc-3/) - The SOC 3 Report , just like SOC 2, is based upon the Trust Service Principles and performed under AT101, the difference being that a SOC 3 Report can be freely distributed (general use) and only reports on if the entity has achieved the Trust Services criteria or not (no description of tests and results
- [Marketing & Advertising for Service Providers w/ SOC Report](https://ssae-16.com/advertising/) - Has your company completed a SOC report? Contact us to help advertise your accomplishment! [si-contact-form form='5']
- [Understanding SaaS Compliance - SSAE 18 / SOC 1 / SOC 2](https://ssae-16.com/what-you-need-to-know-about-saas-compliance-ssae-16-soc-1-soc-2/) - The software publishing industry has experienced significant growth in the past 5 years and projected to continue at a significant pace (2%-5%) as businesses and consumers increase spending and invest in new technology. Businesses account for almost 82% of all software related spending with Finance and Insurance leading the pack. Many of the new enterprise
- [Jobs](https://ssae-16.com/jobs/) - [jobs]
- [SOC 1 (SSAE 18) Data Center and Hosting](https://ssae-16.com/find-a-us-ssae-16-data-center/) - Security, Availability, Processing Integrity, Confidentiality, and Privacy Those are the five core principles which should be built into the control structure of any top tier Data Center / Colocation / Hosting facility. Making use of a Data Center with a successfully completed SSAE 16 (SOC 1) or SOC 2 report covering a combination if not
- [Thank You](https://ssae-16.com/download-our-ssae-16-soc-reporting-guide/thank-you/) - Thank You for requesting our SSAE 16 GuideYou should receive an e-mail with the download link shortly In the mean time, signup for our Mailing List below to receive guidance, white papers, audit tools, and other useful information monthly. Join the SSAE 16 Mailing List! * indicates required Email Address * Name * Company
- [SOC 1 (SSAE 18) Training Services](https://ssae-16.com/training-services/) - Service Providers - How to manage a SSAE 16/SOC 1/SOC 2/SOC 3 Review m User Organizations - How to read a SSAE 16/SOC 1/SOC 2/SOC 3 Report m CPA Firms - How to perform an SSAE 16/SOC 1/SOC 2/SOC 3 Engagement m
- [SSAE-18 - An Update to SSAE 16 (Coming 2017)](https://ssae-16.com/ssae-18-an-update-to-ssae-16-coming-2017/) - SSAE-18 is on the horizon and there are a few key changes from the current SSAE-16 that will help to clarify and formalize requirements for performing and reporting on the examination, review, and agreed-upon procedures engagements to expand the potential of what an SSAE-16 can report on. What do I need to know as a
- [SOC 2 + Additional Subject Matter (SOC2 Plus)](https://ssae-16.com/soc-2/soc-2-additional-subject-matter-soc2-plus/) - The AICPA recently made efforts to expand the use of SOC 2 in two significant ways - additional reporting Criteria and alignment with other significant and at times, required, IT Security regulations. This expansion increases the utility of a SOC 2 report and overall compliance costs and efforts of Businesses small, medium, and large. The Additional
- [Download The SOC Reporting Guide](https://ssae-16.com/download-our-ssae-16-soc-reporting-guide/) - *By requesting this guide, you will receive a follow up email with your download and a potential follow up contact from a Marcum LLP team member. Further, Marcum LLP may choose to add your email address their email list. You are free to opt-out of Marcum LLP emails at any time.
- [HIPAA Compliance - SOC 2](https://ssae-16.com/hipaa-compliance-soc-2/) - Are you a 3rd party service provider for an Insurance Company, Hospital, or other health care related company and handle Personal Health Information (PHI) or Personally Identifiable Information (PII)? Well chances are you will be asked if you are HIPAA Compliant at some point in the near future by one of your vendors. One way
- [Thank You](https://ssae-16.com/vulnerability-assessments-and-penetration-testing-common-issues-found/thank-you/) - Thank You for requesting more information regarding our Vulnerability Assessment and Penetration Testing Services In the mean time, signup for our Mailing List below to receive guidance, white papers, audit tools, and other useful information monthly. Join the SSAE 16 Mailing List! * indicates required Email Address * Name * Company
- [Vulnerability Assessments and Penetration Testing - Common Issues Found](https://ssae-16.com/vulnerability-assessments-and-penetration-testing-common-issues-found/) - In part one of our series on Vulnerability Assessments and Penetration Testing, we will discuss the common issues that usually lead to a finding during an assessment of a company's network or web application. In many cases, the resulting issues are exploitable and can leave valuable data available to hackers. Data breaches are occurring at
- [Join Mailing List](https://ssae-16.com/join-mailing-list/) - Join the SSAE 16 Mailing List! * indicates required Email Address * Name * Company
- [Thank You](https://ssae-16.com/thank-you/) - Thank you for your submission. Please expect a call from someone with Marcum LLP to discuss your audit needs within 24 to 48 hours. In the mean time, signup for our Mailing List below to receive guidance, white papers, audit tools, and other useful information monthly. * indicates required Email Address *

## My Templates

- [Global Post Template](https://ssae-16.com/?elementor_library=elementor-single-post-29086) - Global Post Template SOC 1 Report – Audit / Compliance Hub SOC 2 Report – Audit / Compliance Hub Global Post Template December 1, 2022 3:40 am SOC 2 – CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design
- [S1-2 Hub](https://ssae-16.com/?elementor_library=s1-2-hub) - SOC 1 Report – Audit / Compliance Hub SOC 2 Report – Audit / Compliance Hub
- [Scoping Form](https://ssae-16.com/?elementor_library=scoping-form) - Full Name Email Phone Number Company Name Type of Assistance Required Readiness Assessment Consulting Firm Selection CPA Firm Selection Compliance and Automation Tooling Other SOC Reporting Goals SOC 1 Type 1 SOC 1 Type 2 SOC 2 Type 1 SOC 2 Type 2 SOC 3 Describe current state of SOC reporting program: Penetration Testing Network
- [FAQtemplate](https://ssae-16.com/?elementor_library=faqtemplate) - FAQ: FAQtemplate FAQ: FAQtemplate SOC 2 – CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity’s objectives. Authorizing or Modifying Access
- [Default Kit](https://ssae-16.com/?elementor_library=default-kit)
- [Page Template](https://ssae-16.com/?elementor_library=page-template) - Page Template SOC 2 – CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity’s objectives. Authorizing or Modifying Access How do
- [GlobalHeader](https://ssae-16.com/?elementor_library=globalheader) - Content Area
- [EMAILSIGNUP-SIDEBAR](https://ssae-16.com/?elementor_library=emailsignup-sidebar) - Get Our Emails SOC Reporting Guide Email Subscribe
- [Footer Template](https://ssae-16.com/?elementor_library=footer-template) - Content Area
- [Elementor Search Results #29688](https://ssae-16.com/?elementor_library=elementor-search-results-29688) - Template: Elementor Search Results #29688 Breaking Down SOC 2 CC6.3 Requirements – Controlling Access Control SOC 2 – CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation
- [Elementor Category and Archive Pages](https://ssae-16.com/?elementor_library=elementor-search-results-29623) - Template: Elementor Category and Archive Pages Breaking Down SOC 2 CC6.3 Requirements – Controlling Access Control Read More » Can an organization opt for both SOC2 and ISO 27001? Read More » Can I fail a SOC 2 audit? Read More » SOC 1 Report – Who needs it? Read More » Transition Blueprint: Navigating
- [faqcategory](https://ssae-16.com/?elementor_library=faqcategory)
- [FAQs](https://ssae-16.com/?elementor_library=faqs)
- [SOC1-FAQTemplate](https://ssae-16.com/?elementor_library=soc1-faqtemplate) - SOC 1:
- [soc2-FAQs](https://ssae-16.com/?elementor_library=soc2-faqs) - SOC 2:
- [faqswidget](https://ssae-16.com/?elementor_library=faqswidget)
- [SUBMISSIONFORM](https://ssae-16.com/?elementor_library=submissionform)
- [SOC2](https://ssae-16.com/?elementor_library=soc2) - What is a SOC 2? The Service and Organization Controls 2 Report, formally known as a Service Organization Controls Report as of the most recent update to the SSAE 18 audit standard. A SOC 2 report can cover the design (type 1 report) or operating effectiveness (type 2 report) of controls around a Company’s system over
- [SOC1](https://ssae-16.com/?elementor_library=soc1) - How many updates to SOC 1 have their been? SOC 1 stemmed from the original SAS 70 report, which, once SSAE 16 was issued in April 2010, the formal report name was changed to being a SOC 1 report (but issued under the SSAE 16 guidance) and effective as of June 2011. SSAE 18 was
- [SOCS2-FAQs](https://ssae-16.com/?elementor_library=socs2-faqs) - SOC 2 What is a SOC 2? The Service and Organization Controls 2 Report, formally known as a Service Organization Controls Report as of the most recent update to the SSAE 18 audit standard. A SOC 2 report can cover the design (type 1 report) or operating effectiveness (type 2 report) of controls around a Company’s
- [ssae-FAQs](https://ssae-16.com/?elementor_library=ssae-faqs) - SSAE-18 When is SSAE-18 Effective SSAE-18 is effective for all reports issued after May 1, 2017. Are Representation Letters Required in SSAE 18? Previously in SSAE-16 a Management Representation Letter was highly recommended and common practice, however, they were not explicitly required to be obtained except in certain existing subject matter sections. This is now
- [SOC1-FAQs](https://ssae-16.com/?elementor_library=soc1-faqs) - SOC 1 How many updates to SOC 1 have their been? SOC 1 stemmed from the original SAS 70 report, which, once SSAE 16 was issued in April 2010, the formal report name was changed to being a SOC 1 report (but issued under the SSAE 16 guidance) and effective as of June 2011. SSAE
- [faq-global](https://ssae-16.com/?elementor_library=faq-global) - When is SSAE-18 Effective SSAE-18 is effective for all reports issued after May 1, 2017. Are Representation Letters Required in SSAE 18? Previously in SSAE-16 a Management Representation Letter was highly recommended and common practice, however, they were not explicitly required to be obtained except in certain existing subject matter sections. This is now consistent
- [asdfds](https://ssae-16.com/?elementor_library=asdfds) - SOC 1 and SOC 2: A Comparative Analysis Some organizations have heard of SAS 70, SSAE 16, and now SSAE 18, but, haven’t seen the value, other than because one of their customer Read More » November 22, 2022 No Comments asdfds Read More » Most Popular: Breaking Down SOC 2 CC6.3 Requirements – Controlling
- [Default Kit](https://ssae-16.com/?elementor_library=default-kit-2)

## FAQs

- [Are Third Party Vendor reviews required for SOC 1 and SOC 2?](https://ssae-16.com/faq/are-third-party-vendor-reviews-required-for-soc-1-and-soc-2-3/) - As of the latest SSAE 18 and SOC 2 updates, vendor management and review of any relevant compliance / audit reports (SOC 1, SOC 2, HITRUST, ISO 27001/2, PCI, etc.) has become a key component of monitoring for potential security and compliance risks when outsourcing functions that use a third party’s data.
- [Can an organization opt for both SOC2 and ISO 27001?](https://ssae-16.com/faq/can-an-organization-opt-for-both-soc2-and-iso-27001/) - Yes, they can complement each other. SOC 2 may cover specific areas relevant to service organizations, while ISO 27001 provides a broader approach to information security management.
- [Can I fail a SOC 2 audit?](https://ssae-16.com/faq/can-i-fail-a-soc-2-audit/) - Yes, failure to meet the relevant Trust Service Criteria may result in a failed SOC 2 audit, requiring remediation. This is known as a Qualified Opinion when this happens.
- [SOC 1 Report - Who needs it?](https://ssae-16.com/faq/soc-1-report-who-needs-it/) - Organizations that handle financial transactions, especially those impacting external financial statements, are good examples of those who need SOC1 audits.
- [SOC1 vs SOC2: Differences?](https://ssae-16.com/faq/soc1-vs-soc2-differences/) - At a high-level, SOC1 is about financial controls, while SOC2 focuses on information security controls. They serve different end-user customers and stakeholders.
- [Are Third Party Vendor reviews required for SOC 1 and SOC 2?](https://ssae-16.com/faq/are-third-party-vendor-reviews-required-for-soc-1-and-soc-2/) - As of the latest SSAE 18 and SOC 2 updates, vendor management and review of any relevant compliance / audit reports (SOC 1, SOC 2, HITRUST, ISO 27001/2, PCI, etc.) has become a key component of monitoring for potential security and compliance risks when outsourcing functions that use a third party’s data.
- [What is covered in the Availability criteria?](https://ssae-16.com/faq/what-is-covered-in-the-availability-criteria/) - The availability criteria addresses how you go about ensuring the in-scope data and systems stay online and recoverability should go awry. Disaster recovery: An organization should have a plan in place to recover from a disaster or other catastrophic event that could impact the availability of its systems and data. This might include measures such
- [What are the costs of SOC 2?](https://ssae-16.com/faq/what-are-the-costs-of-soc-2/) - There are a lot of factors that go into responding to this question. There are audit, consulting, software, internal resources, and other factors to consider which can easily grow from $30,000 to $200,000 depending on how the effort is accounted for.
- [What are the SOC 2 criteria?](https://ssae-16.com/faq/what-are-the-soc-2-criteria/) - The five SOC 2 criteria are Security, Availability, Processing Integrity, Confidentiality, and Privacy. Security: Information and systems are protected against unauthorized access, unauthorized disclosure of information, and damage to systems that could compromise the availability, integrity, confidentiality, and privacy of information or systems and affect the entity’s ability to achieve its objectives. Availability: Information and
- [How does a company get SOC 2 certified?](https://ssae-16.com/faq/how-does-a-company-get-soc-2-certified/) - SOC 2 is not a certification, it's a third party attestation of the controls in place at your organization. Typically when a company is asking this question though the answer is you start by understanding your scope (the system, SOC 2 categories, etc.), performing a readiness assessment, and then undergoing either a Type 1 and/or
- [How often is a SOC 2 audit required?](https://ssae-16.com/faq/how-often-is-a-soc-2-audit-required/) - SOC 2 Type II audits should be performed annually, however, there are times you may choose to perform them twice a year. Additionally, if recently completing a SOC 2 Type I, performing a SOC 2 Type II a few months later is also very common.
- [What is SSAE 18 (formerly SSAE 16)?](https://ssae-16.com/faq/what-is-ssae-18-formerly-ssae-16-2/) - A SOC 1 Type 1 report typically costs on average anywhere between $10,000 and $20,000 USD, without the readiness assessment project which most Organizations benefit from and can be an additional $5,000 to $10,000 USD depending on the level of assistance required and project scope.
- [SOC 1 or HITRUST?](https://ssae-16.com/faq/soc-1-or-hitrust/) - The SOC 1 has a completely different purpose than HITRUST. Typically a company would perform both if they are a TPA processing medical claims and other claims, where, there is responsibility for financial reporting and maintaining security over the information being handled.
- [How long does a SOC 1 take to complete?](https://ssae-16.com/faq/how-long-does-a-soc-1-take-to-complete/) - This depends on how prepared and how many resources an Organization has to dedicate to the project. The first time through, usually a readiness assessment would be performed, and then a SOC 1 Type 1, and take anywhere from 2 to 3 months. However, there are situations where it may take 6 to 12 months
- [Are Third Party Vendor reviews required for SOC 1 and SOC 2?](https://ssae-16.com/faq/are-third-party-vendor-reviews-required-for-soc-1-and-soc-2-2/) - As of the latest SSAE 18 and SOC 2 updates, vendor management and review of any relevant compliance / audit reports (SOC 1, SOC 2, HITRUST, ISO 27001/2, PCI, etc.) has become a key component of monitoring for potential security and compliance risks when outsourcing functions that use a third party’s data.
- [We have a small company, how do we segregate Board of Directors from Management, and then, also the Internal Audit function?](https://ssae-16.com/faq/we-have-a-small-company-how-do-we-segregate-board-of-directors-from-management-and-then-also-the-internal-audit-function/) - Depending on the size of your Company, you could look to another small business owner in a similar situation or trusted advisor to sit on each others board’s and create the necessary segregation. As always, consult with your auditor before taking any structural changes.
- [We have a SOC 2. How much effort is GDPR?](https://ssae-16.com/faq/we-have-a-soc-2-how-much-effort-is-gdpr/) - Assuming your Company is subject to GDPR, the level of effort depends a lot on the maturity of Organizational and Privacy controls. The Organizational will be mostly met by implementation of the related latest SOC 2 updates, which is good. However, if you are not currently including Privacy in your SOC 2, and do not
- [What is a SOC 2?](https://ssae-16.com/faq/what-is-a-soc-2/) - The Service and Organization Controls 2 Report, formally known as a Service Organization Controls Report as of the most recent update to the SSAE 18 audit standard. A SOC 2 report can cover the design (type 1 report) or operating effectiveness (type 2 report) of controls around a Company’s system over any number of categories, including,
- [What is SSAE 18 (formerly SSAE 16)?](https://ssae-16.com/faq/what-is-ssae-18-formerly-ssae-16/) - The SSAE 18 audit standard is a framework for reporting on an examination of controls at a service organization relevant to user entities’ internal control over financial reporting.
- [How many updates to SOC 1 have their been?](https://ssae-16.com/faq/how-many-updates-to-soc-1-have-their-been/) - SOC 1 stemmed from the original SAS 70 report, which, once SSAE 16 was issued in April 2010, the formal report name was changed to being a SOC 1 report (but issued under the SSAE 16 guidance) and effective as of June 2011. SSAE 18 was then issued May 2017 and will be effective as of December
- [Are Representation Letters Required in SSAE 18?](https://ssae-16.com/faq/are-representation-letters-required-in-ssae-18/) - Previously in SSAE-16 a Management Representation Letter was highly recommended and common practice, however, they were not explicitly required to be obtained except in certain existing subject matter sections. This is now consistent across all sections.
- [When is SSAE-18 Effective?](https://ssae-16.com/faq/when-is-ssae-18-effective/) - SSAE-18 is effective for all reports issued after May 1, 2017.

## Categories

- [controls](https://ssae-16.com/category/controls/)
- [SAE 16 Terminology](https://ssae-16.com/category/sae-16-terminology/)
- [SOC 1](https://ssae-16.com/category/soc-1/)
- [SOC 2](https://ssae-16.com/category/soc-2/)
- [SOC 3](https://ssae-16.com/category/soc-3/)
- [SSAE 16](https://ssae-16.com/category/ssae-16/)
- [SSAE 16 Preparation](https://ssae-16.com/category/ssae-16-preparation/)
- [SSAE 16 Type I](https://ssae-16.com/category/ssae-16-type-i/)
- [SSAE 16 Type II](https://ssae-16.com/category/ssae-16-type-ii/)
- [SSAE 18](https://ssae-16.com/category/ssae-18/)
- [Terminology](https://ssae-16.com/category/terminology/)
- [Type 1 Report](https://ssae-16.com/category/type-1-report/)
- [Resources](https://ssae-16.com/category/resources/)
- [ssae 22](https://ssae-16.com/category/ssae-22/)
- [at-c 201](https://ssae-16.com/category/at-c-201/)

## Tags

- ["audit" "intensedebate"](https://ssae-16.com/tag/audit-intensedebate/)
- ["leave a reply": "name (required)": "website": "comments": "submit" -moderation](https://ssae-16.com/tag/leave-a-reply-name-required-website-comments-submit-moderation/)
- ['leave a reply' 'name "(required)"' 'mail (will not be published) "(required)"' 'website' "it services"](https://ssae-16.com/tag/leave-a-reply-name-required-mail-will-not-be-published-required-website-it-services/)
- [(isae3402 or ssae16) & part2](https://ssae-16.com/tag/isae3402-or-ssae16-part2/)
- [are soc and systrust the same](https://ssae-16.com/tag/are-soc-and-systrust-the-same/)
- [AT-C 320](https://ssae-16.com/tag/at-c-320/)
- [at101](https://ssae-16.com/tag/at101/)
- [audit](https://ssae-16.com/tag/audit/)
- [audit engagement](https://ssae-16.com/tag/audit-engagement/)
- [availability](https://ssae-16.com/tag/availability/)
- [carve out method sas 70](https://ssae-16.com/tag/carve-out-method-sas-70/)
- [carve out methode](https://ssae-16.com/tag/carve-out-methode/)
- [carve out methodology](https://ssae-16.com/tag/carve-out-methodology/)
- [carve out process](https://ssae-16.com/tag/carve-out-process/)
- [Carve-out Method](https://ssae-16.com/tag/carve-out-method/)
- [checklist](https://ssae-16.com/tag/checklist/)
- [confidentiality](https://ssae-16.com/tag/confidentiality/)
- [control activities](https://ssae-16.com/tag/control-activities/)
- [control objectives](https://ssae-16.com/tag/control-objectives/)
- [controls](https://ssae-16.com/tag/controls/)
- [cost](https://ssae-16.com/tag/cost/)
- [Criteria](https://ssae-16.com/tag/criteria/)
- [definition soc 1 ssae 16](https://ssae-16.com/tag/definition-soc-1-ssae-16/)
- [description of new ssae16](https://ssae-16.com/tag/description-of-new-ssae16/)
- [determine best practices criterion](https://ssae-16.com/tag/determine-best-practices-criterion/)
- [difference between isae 3402 and ssae 16](https://ssae-16.com/tag/difference-between-isae-3402-and-ssae-16/)
- [difference between ssae 16 and isae 3402](https://ssae-16.com/tag/difference-between-ssae-16-and-isae-3402/)
- [difference between ssae and isae](https://ssae-16.com/tag/difference-between-ssae-and-isae/)
- [difference isae 3402 ssae 16](https://ssae-16.com/tag/difference-isae-3402-ssae-16/)
- [differences between isae 3402 and ssae 16](https://ssae-16.com/tag/differences-between-isae-3402-and-ssae-16/)
- [differences between ssae 16 and isae 3402](https://ssae-16.com/tag/differences-between-ssae-16-and-isae-3402/)
- [documentation](https://ssae-16.com/tag/documentation/)
- [effective date of ssae 16](https://ssae-16.com/tag/effective-date-of-ssae-16/)
- [effective date ssae 16](https://ssae-16.com/tag/effective-date-ssae-16/)
- [example of ssae 16 report](https://ssae-16.com/tag/example-of-ssae-16-report/)
- [example soc 1 report](https://ssae-16.com/tag/example-soc-1-report/)
- [example ssae 16 report](https://ssae-16.com/tag/example-ssae-16-report/)
- [FAQs • SOC 1](https://ssae-16.com/tag/faqs-soc-1/)
- [FAQs • SOC 2](https://ssae-16.com/tag/faqs-soc-2/)
- [FAQs • SSAE-18](https://ssae-16.com/tag/faqs-ssae-18/)
- [federal exchange](https://ssae-16.com/tag/federal-exchange/)
- [firewall](https://ssae-16.com/tag/firewall/)
- [firewall configuration](https://ssae-16.com/tag/firewall-configuration/)
- [health care exchange](https://ssae-16.com/tag/health-care-exchange/)
- [how do you prepare for an ssae 16 audit](https://ssae-16.com/tag/how-do-you-prepare-for-an-ssae-16-audit/)
- [how ssea 16 helps auditors](https://ssae-16.com/tag/how-ssea-16-helps-auditors/)
- [how to prepare for a ssae 16](https://ssae-16.com/tag/how-to-prepare-for-a-ssae-16/)
- [how to prepare for an ssae 16 audit](https://ssae-16.com/tag/how-to-prepare-for-an-ssae-16-audit/)
- [how to pronounce ssae 16](https://ssae-16.com/tag/how-to-pronounce-ssae-16/)
- [in an ssae 16 report where are the findings listed?](https://ssae-16.com/tag/in-an-ssae-16-report-where-are-the-findings-listed/)
- [intentional acts in auditing](https://ssae-16.com/tag/intentional-acts-in-auditing/)
- [is ssae 16 needed](https://ssae-16.com/tag/is-ssae-16-needed/)
- [isae 16](https://ssae-16.com/tag/isae-16/)
- [ISAE 3402](https://ssae-16.com/tag/isae-3402/)
- [isae 3402 soc 2](https://ssae-16.com/tag/isae-3402-soc-2/)
- [isae 3402 ssae 16](https://ssae-16.com/tag/isae-3402-ssae-16/)
- [isae 3402 vs ssae 16](https://ssae-16.com/tag/isae-3402-vs-ssae-16/)
- [isae 3402/ssae 16](https://ssae-16.com/tag/isae-3402ssae-16/)
- [isae vs ssae](https://ssae-16.com/tag/isae-vs-ssae/)
- [isae3402 soc2](https://ssae-16.com/tag/isae3402-soc2/)
- [isae3402 ssae16](https://ssae-16.com/tag/isae3402-ssae16/)
- [isae3402 vs ssae16](https://ssae-16.com/tag/isae3402-vs-ssae16/)
- [management must provide](https://ssae-16.com/tag/management-must-provide/)
- [mandatory ssae16 controls](https://ssae-16.com/tag/mandatory-ssae16-controls/)
- [new avenues for ssae 16](https://ssae-16.com/tag/new-avenues-for-ssae-16/)
- [new ssae 16](https://ssae-16.com/tag/new-ssae-16/)
- [new ssae 16 standard](https://ssae-16.com/tag/new-ssae-16-standard/)
- [p&p controls](https://ssae-16.com/tag/pp-controls/)
- [policies and procedures](https://ssae-16.com/tag/policies-and-procedures/)
- [preparing for a ssae 16](https://ssae-16.com/tag/preparing-for-a-ssae-16/)
- [preparing for ssae 16](https://ssae-16.com/tag/preparing-for-ssae-16/)
- [prices](https://ssae-16.com/tag/prices/)
- [pricing](https://ssae-16.com/tag/pricing/)
- [procedures](https://ssae-16.com/tag/procedures/)
- [processing integrity](https://ssae-16.com/tag/processing-integrity/)
- [readiness assessment](https://ssae-16.com/tag/readiness-assessment/)
- [report writing](https://ssae-16.com/tag/report-writing/)
- [reports](https://ssae-16.com/tag/reports/)
- [required documents for auditing](https://ssae-16.com/tag/required-documents-for-auditing/)
- [requirements for ssae 16](https://ssae-16.com/tag/requirements-for-ssae-16/)
- [reviewing ssae 16](https://ssae-16.com/tag/reviewing-ssae-16/)
- [sample soc 2 report](https://ssae-16.com/tag/sample-soc-2-report/)
- [sample ssae 16](https://ssae-16.com/tag/sample-ssae-16/)
- [sample ssae 16 report](https://ssae-16.com/tag/sample-ssae-16-report/)
- [SAS 70](https://ssae-16.com/tag/sas-70/)
- [sas 70 carve out method](https://ssae-16.com/tag/sas-70-carve-out-method/)
- [SAS70](https://ssae-16.com/tag/sas70/)
- [sase 16 requirements](https://ssae-16.com/tag/sase-16-requirements/)
- [scope](https://ssae-16.com/tag/scope/)
- [security](https://ssae-16.com/tag/security/)
- [service auditors](https://ssae-16.com/tag/service-auditors/)
- [sixteen control](https://ssae-16.com/tag/sixteen-control/)
- [soc 1](https://ssae-16.com/tag/soc-1/)
- [soc 1 audit](https://ssae-16.com/tag/soc-1-audit/)
- [soc 1 report](https://ssae-16.com/tag/soc-1-report-2/)
- [soc 1 reports](https://ssae-16.com/tag/soc-1-reports/)
- [soc 1 review checklist](https://ssae-16.com/tag/soc-1-review-checklist/)
- [soc 1 type 2](https://ssae-16.com/tag/soc-1-type-2/)
- [soc 1 type 2 report](https://ssae-16.com/tag/soc-1-type-2-report/)
- [soc 1 type ii report](https://ssae-16.com/tag/soc-1-type-ii-report/)
- [soc 2](https://ssae-16.com/tag/soc-2/)
- [soc 2 controls](https://ssae-16.com/tag/soc-2-controls/)
- [soc 2 principles](https://ssae-16.com/tag/soc-2-principles/)
- [soc 2 report](https://ssae-16.com/tag/soc-2-report/)
- [soc 2 report user](https://ssae-16.com/tag/soc-2-report-user/)
- [soc 2 reports](https://ssae-16.com/tag/soc-2-reports/)
- [soc 2 trust principles](https://ssae-16.com/tag/soc-2-trust-principles/)
- [soc 2 vs webtrust](https://ssae-16.com/tag/soc-2-vs-webtrust/)
- [SOC 3](https://ssae-16.com/tag/soc-3/)
- [soc 3 example](https://ssae-16.com/tag/soc-3-example/)
- [SOC 3 Report](https://ssae-16.com/tag/soc-3-report/)
- [soc 3 reporting](https://ssae-16.com/tag/soc-3-reporting/)
- [soc checklist](https://ssae-16.com/tag/soc-checklist/)
- [soc i](https://ssae-16.com/tag/soc-i/)
- [SOC Report](https://ssae-16.com/tag/soc-report/)
- [soc reporting](https://ssae-16.com/tag/soc-reporting/)
- [soc type](https://ssae-16.com/tag/soc-type/)
- [soc type 1 report](https://ssae-16.com/tag/soc-type-1-report/)
- [soc-1 report](https://ssae-16.com/tag/soc-1-report-3/)
- [soc1](https://ssae-16.com/tag/soc1/)
- [soc1 report](https://ssae-16.com/tag/soc1-report/)
- [soc1 reporting](https://ssae-16.com/tag/soc1-reporting/)
- [soc1 soc2](https://ssae-16.com/tag/soc1-soc2/)
- [soc2](https://ssae-16.com/tag/soc2/)
- [SOC3](https://ssae-16.com/tag/soc3/)
- [SOC3 report](https://ssae-16.com/tag/soc3-report/)
- [solutions](https://ssae-16.com/tag/solutions/)
- [sop template ssae-16](https://ssae-16.com/tag/sop-template-ssae-16/)
- [ssae 10 versus isae](https://ssae-16.com/tag/ssae-10-versus-isae/)
- [SSAE 16](https://ssae-16.com/tag/ssae-16/)
- [ssae 16 and isae 3402 differences](https://ssae-16.com/tag/ssae-16-and-isae-3402-differences/)
- [ssae 16 audit](https://ssae-16.com/tag/ssae-16-audit/)
- [ssae 16 audit checklist](https://ssae-16.com/tag/ssae-16-audit-checklist/)
- [ssae 16 audit preparation](https://ssae-16.com/tag/ssae-16-audit-preparation/)
- [ssae 16 audit report](https://ssae-16.com/tag/ssae-16-audit-report/)
- [ssae 16 audit requirements](https://ssae-16.com/tag/ssae-16-audit-requirements/)
- [ssae 16 audit review](https://ssae-16.com/tag/ssae-16-audit-review/)
- [ssae 16 auditing standard](https://ssae-16.com/tag/ssae-16-auditing-standard/)
- [ssae 16 auditor](https://ssae-16.com/tag/ssae-16-auditor/)
- [ssae 16 carve out](https://ssae-16.com/tag/ssae-16-carve-out/)
- [ssae 16 carve-out method](https://ssae-16.com/tag/ssae-16-carve-out-method/)
- [ssae 16 checklist](https://ssae-16.com/tag/ssae-16-checklist/)
- [ssae 16 consulting do we need](https://ssae-16.com/tag/ssae-16-consulting-do-we-need/)
- [ssae 16 control objectives](https://ssae-16.com/tag/ssae-16-control-objectives/)
- [ssae 16 controls](https://ssae-16.com/tag/ssae-16-controls/)
- [ssae 16 cost](https://ssae-16.com/tag/ssae-16-cost/)
- [ssae 16 costs](https://ssae-16.com/tag/ssae-16-costs/)
- [ssae 16 criteria](https://ssae-16.com/tag/ssae-16-criteria/)
- [ssae 16 criteria manual](https://ssae-16.com/tag/ssae-16-criteria-manual/)
- [ssae 16 definitions glossary](https://ssae-16.com/tag/ssae-16-definitions-glossary/)
- [ssae 16 documentation](https://ssae-16.com/tag/ssae-16-documentation/)
- [ssae 16 documents](https://ssae-16.com/tag/ssae-16-documents/)
- [ssae 16 effective date](https://ssae-16.com/tag/ssae-16-effective-date/)
- [ssae 16 example](https://ssae-16.com/tag/ssae-16-example/)
- [ssae 16 examples](https://ssae-16.com/tag/ssae-16-examples/)
- [ssae 16 five principles](https://ssae-16.com/tag/ssae-16-five-principles/)
- [ssae 16 framework](https://ssae-16.com/tag/ssae-16-framework/)
- [ssae 16 guidance](https://ssae-16.com/tag/ssae-16-guidance/)
- [ssae 16 implementation date](https://ssae-16.com/tag/ssae-16-implementation-date/)
- [ssae 16 intentional act](https://ssae-16.com/tag/ssae-16-intentional-act/)
- [ssae 16 isae 3402](https://ssae-16.com/tag/ssae-16-isae-3402/)
- [SSAE 16 Preparation](https://ssae-16.com/tag/ssae-16-preparation/)
- [ssae 16 prices](https://ssae-16.com/tag/ssae-16-prices/)
- [ssae 16 process mapping guide](https://ssae-16.com/tag/ssae-16-process-mapping-guide/)
- [ssae 16 report](https://ssae-16.com/tag/ssae-16-report/)
- [ssae 16 report example](https://ssae-16.com/tag/ssae-16-report-example/)
- [ssae 16 reports](https://ssae-16.com/tag/ssae-16-reports/)
- [ssae 16 requirements](https://ssae-16.com/tag/ssae-16-requirements/)
- [SSAE 16 Review](https://ssae-16.com/tag/ssae-16-review/)
- [ssae 16 review checklist](https://ssae-16.com/tag/ssae-16-review-checklist/)
- [ssae 16 reviews](https://ssae-16.com/tag/ssae-16-reviews/)
- [ssae 16 sample controls](https://ssae-16.com/tag/ssae-16-sample-controls/)
- [ssae 16 sample report](https://ssae-16.com/tag/ssae-16-sample-report/)
- [ssae 16 sample reports](https://ssae-16.com/tag/ssae-16-sample-reports/)
- [ssae 16 service organization](https://ssae-16.com/tag/ssae-16-service-organization/)
- [ssae 16 service organization control](https://ssae-16.com/tag/ssae-16-service-organization-control/)
- [ssae 16 service organizations](https://ssae-16.com/tag/ssae-16-service-organizations/)
- [ssae 16 services](https://ssae-16.com/tag/ssae-16-services/)
- [ssae 16 soc 1](https://ssae-16.com/tag/ssae-16-soc-1/)
- [ssae 16 soc 2](https://ssae-16.com/tag/ssae-16-soc-2/)
- [ssae 16 soc 3](https://ssae-16.com/tag/ssae-16-soc-3/)
- [ssae 16 soc 3 report](https://ssae-16.com/tag/ssae-16-soc-3-report/)
- [ssae 16 soc2](https://ssae-16.com/tag/ssae-16-soc2/)
- [ssae 16 standard](https://ssae-16.com/tag/ssae-16-standard/)
- [SSAE 16 Terminology](https://ssae-16.com/tag/ssae-16-terminology/)
- [ssae 16 terms](https://ssae-16.com/tag/ssae-16-terms/)
- [ssae 16 testing definition](https://ssae-16.com/tag/ssae-16-testing-definition/)
- [ssae 16 type](https://ssae-16.com/tag/ssae-16-type/)
- [ssae 16 type 1](https://ssae-16.com/tag/ssae-16-type-1/)
- [ssae 16 type 1 report](https://ssae-16.com/tag/ssae-16-type-1-report/)
- [ssae 16 type 2](https://ssae-16.com/tag/ssae-16-type-2/)
- [ssae 16 type i](https://ssae-16.com/tag/ssae-16-type-i/)
- [ssae 16 type ii](https://ssae-16.com/tag/ssae-16-type-ii-2/)
- [ssae 16 type ii report](https://ssae-16.com/tag/ssae-16-type-ii-report/)
- [ssae 16 type ii standard](https://ssae-16.com/tag/ssae-16-type-ii-standard/)
- [ssae 16 vs isae 3402](https://ssae-16.com/tag/ssae-16-vs-isae-3402/)
- [ssae 16/isae 3402](https://ssae-16.com/tag/ssae-16isae-3402/)
- [ssae 17 audit](https://ssae-16.com/tag/ssae-17-audit/)
- [SSAE 18 Report](https://ssae-16.com/tag/ssae-18-report/)
- [ssae carve out method](https://ssae-16.com/tag/ssae-carve-out-method/)
- [SSAE No. 16](https://ssae-16.com/tag/ssae-no-16/)
- [ssae review](https://ssae-16.com/tag/ssae-review/)
- [ssae reviews](https://ssae-16.com/tag/ssae-reviews/)
- [ssae soc auditing and reporting](https://ssae-16.com/tag/ssae-soc-auditing-and-reporting/)
- [ssae standards](https://ssae-16.com/tag/ssae-standards/)
- [ssae vs isae](https://ssae-16.com/tag/ssae-vs-isae/)
- [ssae-16 type ii](https://ssae-16.com/tag/ssae-16-type-ii-3/)
- [ssae-18](https://ssae-16.com/tag/ssae-18/)
- [SSAE16](https://ssae-16.com/tag/ssae16/)
- [ssae16 and isae 3402](https://ssae-16.com/tag/ssae16-and-isae-3402/)
- [ssae16 audit](https://ssae-16.com/tag/ssae16-audit/)
- [ssae16 audit report](https://ssae-16.com/tag/ssae16-audit-report/)
- [ssae16 availability criteria](https://ssae-16.com/tag/ssae16-availability-criteria/)
- [ssae16 carve out](https://ssae-16.com/tag/ssae16-carve-out/)
- [ssae16 carve out method](https://ssae-16.com/tag/ssae16-carve-out-method/)
- [ssae16 checkilst](https://ssae-16.com/tag/ssae16-checkilst/)
- [ssae16 compliant soc 1](https://ssae-16.com/tag/ssae16-compliant-soc-1/)
- [ssae16 controls and and control objectives](https://ssae-16.com/tag/ssae16-controls-and-and-control-objectives/)
- [ssae16 criteria](https://ssae-16.com/tag/ssae16-criteria/)
- [ssae16 example](https://ssae-16.com/tag/ssae16-example/)
- [ssae16 isae 3402](https://ssae-16.com/tag/ssae16-isae-3402/)
- [ssae16 review](https://ssae-16.com/tag/ssae16-review/)
- [ssae16 sample report](https://ssae-16.com/tag/ssae16-sample-report/)
- [ssae16 vs isae 3402](https://ssae-16.com/tag/ssae16-vs-isae-3402/)
- [ssae16 vs isae3402](https://ssae-16.com/tag/ssae16-vs-isae3402/)
- [standards](https://ssae-16.com/tag/standards/)
- [Subservice Organization](https://ssae-16.com/tag/subservice-organization/)
- [system and organization control report](https://ssae-16.com/tag/system-and-organization-control-report/)
- [system organization control report](https://ssae-16.com/tag/system-organization-control-report/)
- [systrust](https://ssae-16.com/tag/systrust/)
- [systrust report](https://ssae-16.com/tag/systrust-report/)
- [technical differences between ssae16 and isae3402](https://ssae-16.com/tag/technical-differences-between-ssae16-and-isae3402/)
- [third party ssae guidance review](https://ssae-16.com/tag/third-party-ssae-guidance-review/)
- [trust](https://ssae-16.com/tag/trust/)
- [trust principles](https://ssae-16.com/tag/trust-principles/)
- [trust service principles](https://ssae-16.com/tag/trust-service-principles/)
- [type 1 report](https://ssae-16.com/tag/type-1-report/)
- [type 1 ssae 16 report](https://ssae-16.com/tag/type-1-ssae-16-report/)
- [Type I Report](https://ssae-16.com/tag/type-i-report/)
- [webtrust](https://ssae-16.com/tag/webtrust/)
- [webtrust vs systrust](https://ssae-16.com/tag/webtrust-vs-systrust/)
- [what does company need to provide for audit](https://ssae-16.com/tag/what-does-company-need-to-provide-for-audit/)
- [what does ssae 16 provide](https://ssae-16.com/tag/what-does-ssae-16-provide/)
- [what information do auditors need](https://ssae-16.com/tag/what-information-do-auditors-need/)
- [what is a soc 1 report](https://ssae-16.com/tag/what-is-a-soc-1-report/)
- [what is a soc 2 report](https://ssae-16.com/tag/what-is-a-soc-2-report/)
- [what is a soc1 report](https://ssae-16.com/tag/what-is-a-soc1-report/)
- [what is a ssae 16 audit](https://ssae-16.com/tag/what-is-a-ssae-16-audit/)
- [what is carve out method](https://ssae-16.com/tag/what-is-carve-out-method/)
- [what is ssae 16 audit](https://ssae-16.com/tag/what-is-ssae-16-audit/)
- [what is ssae 16 soc 1 and soc 2 difference](https://ssae-16.com/tag/what-is-ssae-16-soc-1-and-soc-2-difference/)
- [what is ssae16 audit](https://ssae-16.com/tag/what-is-ssae16-audit/)
- [what is the purpose of a ssae 16 audit?](https://ssae-16.com/tag/what-is-the-purpose-of-a-ssae-16-audit/)
- [what kind of engagements could you as auditor provide](https://ssae-16.com/tag/what-kind-of-engagements-could-you-as-auditor-provide/)
- [what to provide to auditors](https://ssae-16.com/tag/what-to-provide-to-auditors/)
- [who is required to have a ssae 16](https://ssae-16.com/tag/who-is-required-to-have-a-ssae-16/)
- [who is required to have ssae 16](https://ssae-16.com/tag/who-is-required-to-have-ssae-16/)
- [why get ssae 16](https://ssae-16.com/tag/why-get-ssae-16/)
- [why organisations need auditors.](https://ssae-16.com/tag/why-organisations-need-auditors/)
- [will auditors be needed?](https://ssae-16.com/tag/will-auditors-be-needed/)
- [audit resources](https://ssae-16.com/tag/audit-resources/)
- [scripts](https://ssae-16.com/tag/scripts/)
- [soc 2 process](https://ssae-16.com/tag/soc-2-process/)
- [guide](https://ssae-16.com/tag/guide/)
- [iso 27001](https://ssae-16.com/tag/iso-27001/)
- [tprm](https://ssae-16.com/tag/tprm/)
- [vendor risk](https://ssae-16.com/tag/vendor-risk/)

## FAQ Categories

- [FAQs • SOC 1](https://ssae-16.com/faqs/soc1/)
- [FAQs • SOC 2](https://ssae-16.com/faqs/soc2/)
- [FAQs • SSAE-18](https://ssae-16.com/faqs/ssae18/)