SSAE 18 and SOC 1: What Changed From SSAE 16?
What the historical SSAE 18 transition changed, why SOC 1 remains focused on financial-reporting controls, and how to scope preparation today.
- November 9, 2026
Menu
Day: October 22, 2022
Contact a SOC 1 or SOC 2 Consultant Now
Vulnerability Assessment and Penetration Testing
Get Our Emails
SOC Reporting Guide
Menu
Popular SSAE Resources
Firewall Controls in SOC 1 and SOC 2: A Practical Example
See how a firewall control can connect risks, approved rules, monitoring and evidence without treating one technology as a universal SOC requirement.
What Should We Ask a Vendor About Its Fourth-Party Dependencies?
Ask about the subcontractors and other dependencies that could affect your service, and how your vendor oversees them.
SOC 1 for a small outsourced bookkeeping team: controls from intake to close
A practical SOC 1 starting point for smaller outsourced bookkeeping teams. Cover source records, posting, reconciliation, adjustments and customer review with evidence from ordinary work.
SOC Preparation: Make Control Descriptions Match the Process
Walk through actual work with process owners, document control changes honestly, and keep evidence aligned with the period being examined.
Healthcare SaaS support: keep patient data out of the wrong tools
Screenshots and support exports can spread patient information beyond the application. Use simple controls for the tools and people handling them.
A customer wants SOC 2. Can a penetration test help while we wait?
A relevant test may help a customer assess risk before your SOC 2 report is ready. Agree on the evidence and limits without claiming it replaces the audit.