System and Organization Controls: SOC Suite of Services

• SOC 1® - SOC for Service Organizations: ICFR
  To provide management of the service organization, user entities, and the independent auditors of user entities’ financial statements with information and a services auditor’s opinion about controls at a service organization that are likely to be relevant to user entities’ internal control over financial reporting.
  

  Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting (SOC 1®)	Information for management of a service organization in a SOC 1® engagement	SOC Overview Document	SOC Toolkit
  2023 SOC Survey	Common Peer Review Deficiencies – SOC 1 and SOC 2	Implications of the Use of Blockchain in SOC for Service Organization Examinations	CPAs: Helping service organizations build trust and transparency
  CPA firms: Your premier provider for SOC for Service Organizations	AICPA System and Organization Controls communications guidelines	SOC Logo for CPAs	SOC Logo for Service Organizations

• SOC 2® - SOC for Service Organizations: Trust Services Criteria
  To provide service organization management, user entities, business partners, and other parties with information about controls at the service organization relevant to security, availability, processing integrity, confidentiality, or privacy to support understanding and managing the risks arising from business relationships with service providers.
  

  SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy	2017 Trust Services Criteria (With Revised Points of Focus – 2022)	2018 SOC 2® Description Criteria (With Revised Implementation Guidance – 2022)	Trust Services Criteria Mappings
  Illustrative SOC 2® Report with Illustrative System Description	Illustrative Management Representation Letter: SOC 2® Type 1	Illustrative Management Representation Letter: SOC 2® Type 2	Addressing additional subject matter and criteria in SOC 2® engagement
  Information for Service Organization Management in a SOC 2® Engagement	Explore SOC for Service Organizations: Information for CPAs	SOC 2® examinations and SOC for Cybersecurity examinations: Understanding the key distinctions	Comparison of SOC 2® , SOC for Supply Chain, and SOC for Cybersecurity Examinations and Related Report
  Data privacy services chart	Privacy Considerations in a SOC 2® Examination	FAQs - Effect of the use of software tools on SOC 2® examinations	FAQs – SOC 2(R) & SOC 3(R) Examinations
  Common Peer Review Deficiencies – SOC 1 and SOC 2	Implications of the Use of Blockchain in SOC for Service Organization Examinations	How to Perform Proper Vendor Management	Key Elements of a SOC 2 Report – Resources for Management
  CPAs: Helping service organizations build trust and transparency	CPA firms: Your premier provider for SOC for Service Organizations	SOC Overview Document	SOC Toolkit
  2023 SOC Survey	AICPA System and Organization Controls communications guidelines	SOC Logo for CPAs	SOC Logo for Service Organizations

• SOC 3® - SOC for Service Organizations: Trust Services Criteria for General Use Report
  To provide interested parties with a service auditor’s opinion about the effectiveness of controls at the service organization relevant to security, availability, processing integrity, confidentiality, or privacy.
  

  SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy	2017 Trust Services Criteria (With Revised Points of Focus – 2022)	2018 SOC 2® Description Criteria (With Revised Implementation Guidance – 2022)	Trust Services Criteria Mappings
  Illustrative SOC 3 report	Read the latest FAQs for SOC 2® and SOC 3® Examinations	CPAs: Helping service organizations build trust and transparency	CPA firms: Your premier provider for SOC for Service Organizations
  SOC Overview Document	SOC Toolkit	2023 SOC Survey	AICPA System and Organization Controls communications guidelines
  SOC Logo for CPAs	SOC Logo for Service Organizations

• SOC for Cybersecurity
  To provide general users with useful information about an entity’s cybersecurity risk management program for making informed decisions.
  

  Reporting on an Entity's Cybersecurity Risk Management Program and Controls	2017 Trust Services Criteria (With Revised Points of Focus – 2022)	Description Criteria for Management’s Description of the Entity’s Cybersecurity Risk Management Program	Illustrative Cybersecurity Risk Management report
  SOC for Cybersecurity: Information for CPAs	SOC for Cybersecurity: Information for organizations	SOC for Cybersecurity: Information for users	What Management Needs to Know About the Cybersecurity Rules
  SOC 2® examinations and SOC for Cybersecurity examinations: Understanding the key distinctions	Comparison of SOC 2® , SOC for Supply Chain, and SOC for Cybersecurity Examinations and Related Report	SOC for Cybersecurity Brochure	AICPA System and Organization Controls communications guidelines

• SOC for Supply Chain
  To provide specified users with information about the controls within the entity’s system relevant to security, availability, processing integrity, confidentiality, or privacy to enable users to better understand and manage the risks arising from business relationships with their supplier and distribution networks.
  

  Reporting on an Examination of Controls Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy in a Production, Manufacturing, or Distribution System	2017 Trust Services Criteria (With Revised Points of Focus – 2022)	SOC for Supply Chain Description Criteria	Illustrative SOC for Supply Chain report
  Learn about SOC for supply chain	Comparison of SOC 2® , SOC for Supply Chain, and SOC for Cybersecurity Examinations and Related Report	What Management Needs to Know about SOC for Supply Chain	AICPA System and Organization Controls communications guidelines

For resources related to each SOC service, see SOC Suite of Services above.

This overview document discusses the three types of SOC for Service Organization engagements: SOC 1®, SOC 2®, and SOC 3®

• 2023 SOC Survey
  Discover the latest trends in SOC reporting.
  

• SOC for Service Organizations Toolkit
  The SOC for services organizations toolkit provides resources for CPA firms that do not currently provide SOC for service organizations examinations (SOC 1®, SOC 2®, and SOC 3® examinations) but are interested in entering this space.
  

• SOC for Service Organizations: Information for CPAs
  The AICPA has developed 3 different SOC for Service Organizations engagements (SOC 1®, SOC 2® and SOC 3®) that involve reporting on controls at a service organization. Learn more about each here.
  

• SOC for Cybersecurity: Information for CPAs
  SOC for Cybersecurity enables CPAs to examine and report on an organization’s cybersecurity risk management program.

• SOC Overview Document
  This overview document discusses the three types of SOC for Service Organization engagements: SOC 1®, SOC 2®, and SOC 3®

• Information for Service Organization Management in a SOC 1® Engagement
  This publication is intended to assist management of a service organization in understanding its responsibilities in a SOC 1® engagement.

• Information for Service Organization Management in a SOC 2® Engagement
  This document provides information that management of the service organization needs to know when undergoing a SOC 2 examination.

• SOC for Cybersecurity: Information for Organizations
  SOC for cybersecurity helps organizations communicate about their cybersecurity risk management program and the effectiveness of controls within that program.

• SOC Overview Document
  This overview document discusses the three types of SOC for Service Organization engagements: SOC 1®, SOC 2®, and SOC 3®.

• SOC for Cybersecurity: Information for Users
  SOC for Cybersecurity helps organizations communicate about their cybersecurity risk management programs and CPAs to examine and report on such information.

• What management needs to know about the SEC Cybersecurity Rules
  Learn more about the SEC’s new cybersecurity disclosure rules.

• SOC Logo for CPAs — Registration and Guidelines
  AICPA SOC for Service Organizations Logo for use by CPAs — Register here.
  

• SOC Logo for Service Organizations — Registration and Guidelines
  AICPA SOC for Service Organizations Logo for use by service organizations — Register here.

• Maintaining high standards for SOC engagements
  Insights on auditing system-level controls of a service organization or entity-level controls of other organizations. Strengthen your ability with these tips.

• 5 tips for third-party vendor management
  Third-party vendor risk management distilled with 5 solutions to common challenges.