SSAE numbers identify attestation standards, not SOC 1 report versions. The major historical changes were SSAE 16 replacing SAS 70 for service-auditor reporting in 2011, followed by SSAE 18 in 2017. That sequence is not an exhaustive count of amendments: later statements have also changed the applicable requirements. For a current SOC 1 engagement, check the applicable AT-C standards as amended rather than treating the number 18 as the latest report version.
When are we ready to start a SOC 2 Type 2 reporting period?
Discuss the start date with the auditor after the in-scope controls are implemented and evidence collection is working. Check actual operation: can you retrieve an access approval, a completed review,
