SOC for Cybersecurity – What It Is and Who It’s For

The AICPA has created a new examination engagement to sit alongside the System and Organization Controls (SOC) 1, 2 and 3. That’s right, SOC no longer stands for “Service Organization Controls.”

And, the AICPA isn’t done yet... they’re working on a “SOC for Vendor Supply Chains” as well. For this post’s purpose, though, we’ll stick with the new SOC for Cybersecurity.

What The SOC for Cybersecurity Covers

Engagements following the SOC for Cybersecurity guidance will be most similar to SOC 2 analyses, in that they’ll use a subset of the Trust Service Principles: Security, Availability, and Confidentiality. This omits the Processing Integrity and Privacy Trust Service Principles. The similarities don’t stop with the Trust Service Principles. The SOC for Cybersecurity will also contain the following similar sections and types:

Management’s Assertion – Management asserting that “(a) the description is presented in accordance with the description criteria and (b) the controls within the entity’s cybersecurity risk management program were effective to achieve the entity’s cybersecurity objectives based on the control criteria.” (aicpa.org)

Management’s Description – In this case, it's the description of the entity's cybersecurity risk management program instead of the general System.

Auditor’s Report – The third party auditor’s opinion on whether “(a) the description is presented in accordance with the description criteria and (b) the controls within the entity’s cybersecurity risk management program were effective to achieve the entity’s cybersecurity objectives based on the control criteria.” (aicpa.org)

Type I and II – Like the SOC 1 and 2, the SOC for Cybersecurity offers a point-in-time assessment covering the design of the controls, a Type I, and a period-of-time examination covering the operating effectiveness of the controls, a Type II.

The reports will cover two sets of benchmarks, which are used to measure or evaluate the organization’s Cybersecurity Risk Management Program:

1. Description Criteria
2. Control Criteria

There are 19 description criteria outlined and available for use by organizations which are to be discussed in Management’s Description of the report. Each of these description criteria includes guidance for implementing the controls. The control criteria will be chosen from the Security, Availability and Confidentiality Trust Services Principle’s common controls.

Who's Expected to Use This SOC for Cybersecurity?

Need content here

Why Choose SOC for Cybersecurity vs SOC 2?

Need content here 

The AICPA has provided a good set of reference materials for use by auditors and organizations which can be found at aicpa.org.

Do you know how to analyze a SOC report? Download our eBook to learn more.