SSAE 18 and SOC 1: What Changed From SSAE 16?
What the historical SSAE 18 transition changed, why SOC 1 remains focused on financial-reporting controls, and how to scope preparation today.
SOC Reporting Guide
SOC 1 · SOC 2 · SOC 3 guidance
Evidence → Review → Report
Build a practical path to SOC 2
Welcome to the SOC Reporting Guide – The Original SOC 1 / SOC 2 Resource Center
Prepare with your own team, advisory support, software, or a mix, and choose an independent auditor for the examination. Modernize everyday processes, assign evidence owners, and build repeatable routines, with or without new tools.
Compare SOC 1 and SOC 2
Explore the differences between SOC 1 and SOC 2 reports.
Build repeatable processes
Start with the preparation checklist. Assign owners for controls and evidence, and plan work your team can repeat.
Third-party risk
Understand vendor and fourth-party dependencies, and choose practical ways to manage the risk.
Choose your support
Discuss your internal resources, advisory needs, and software options with a SOC provider.
Automated testing, manual penetration testing and red teaming: what is acceptable?
Choose automated checks, assessor-led penetration testing and red-team exercises against your security objectives and applicable obligations.
How to review a vendor penetration-test report
Turn a test report into a documented accept, clarify or escalate decision based on scope and unresolved risk.
AI application security testing: scope, permissions and reassessment
Scope AI application security evaluation around data flows, retrieval permissions, tool actions, configuration and material changes.
Kubernetes security assessments: what a container scan leaves out
Scope Kubernetes assessment across applications, workloads, cluster administration, isolation and managed-service responsibilities.
Cloud security testing: scope, identity and shared responsibility
Plan cloud security assessment scope around accounts, identities, data services, configuration and shared responsibility.
Internal and external network testing: two different questions
Define external and internal network assessment boundaries, starting access, coverage, operational safeguards and retest evidence.
Web application and API penetration testing: defining the right scope
Define web application and API assessment scope by architecture, user roles, customer separation, business workflows and verification evidence.
When Do Third-Party Risk Tools Actually Help?
Choose tools for demonstrated workflow problems, and keep the service-specific risk decision with an accountable person.
Get Our Emails
SOC Reporting Guide
Menu