Outside the US it is the usual basis for an assurance report on security controls. The criteria have to be stated in the report, and can be the AICPA Trust Services Criteria, a control set based on ISO 27002, or criteria the service organization defines.
The comparison of SOC 2 and the ISAE standards covers when buyers ask for it.
Read more
Related terms
- ISAE 3402
- ISAE 3402 is the IAASB's international standard for assurance reports on controls at a service organization relevant to customers' financial reporting.
- SOC 2
- SOC 2 is an attestation report in which a CPA firm gives an opinion on a service organization's controls against the AICPA Trust Services Criteria.
- Attestation engagement
- An attestation engagement is an engagement in which an independent practitioner reports on a subject matter, or on someone else's assertion about it.