SSAE-18 became effective for practitioners’ reports dated on or after May 1, 2017.
Have the product owner check for AI changes in: Ask the vendor and internal users whether AI has been added, whether it is enabled by default, and what information it
The Availability criteria address whether information and systems are available for use as needed to meet the service commitments and system requirements in scope. Practical work includes capacity planning, monitoring,
Begin with what you promise customers and how the service could fail to meet those promises. Security is the foundation; discuss additional categories with the auditor based on the system,
AIUC-1 is an AI-focused standard maintained by the Artificial Intelligence Underwriting Company. Its published scope addresses data and privacy, security, safety, reliability, accountability, and societal risks. It is separate from
SOC 2 is not a simple pass-or-fail certification. The report may contain an unmodified, qualified, or adverse opinion, or a disclaimer of opinion. A control exception does not automatically mean
The five SOC 2 categories are Security, Availability, Processing Integrity, Confidentiality, and Privacy. Not every SOC 2 report covers all five categories. Read the report to see which categories and
SOC Reporting Guide
Copyright 2026 © All rights Reserved.
