Choose based on the assurance your customers need. SOC 1 addresses controls relevant to customers’ internal control over financial reporting. HITRUST offers cybersecurity assessments and certifications with different scopes and levels of assurance. A third-party administrator processing medical claims may be asked for both: one for financial-reporting controls and the other for information protection. Confirm the requested HITRUST assessment, covered systems, and contractual requirements rather than assuming every claims processor needs both. Neither deliverable automatically substitutes for the other.
Are Third Party Vendor reviews required for SOC 1 and SOC 2?
Review outsourced services that can affect the in-scope system or controls. The extent of review should reflect the service and its risks. Where a vendor supplies an assurance report, assess
