It sets out the services provided, commitments and system requirements, the components of the system, significant incidents, the controls, complementary controls and significant changes. The auditor's opinion covers whether it is fairly presented.
The guide to the system description covers each section.
Read more
Related terms
- Management's assertion
- Management's assertion is the signed statement in a SOC report that the service organization's description and controls meet the criteria.
- Complementary user entity controls
- Complementary user entity controls are controls a SOC report assumes the service organization's customers operate themselves for the criteria to be met.
- Subservice organization
- A subservice organization is a vendor that performs part of the service a SOC report covers, such as a cloud hosting provider or a managed database service.