Question

Difficulty: Very hardSecurity Audits, Assessments, and Attestations

A enterprise healthcare technology organization is preparing for a mandatory annual compliance review by an independent external auditing firm. The compliance officer must supply an independent attestation document that proves internal data security controls over sensitive electronic protected health information (ePHI) were not only appropriately designed and implemented, but also maintained and operated effectively over a continuous 12-month evaluation window. Which of the following audit reports or attestations fulfills both the time-horizon and operational testing criteria required by the auditors?

  1. A SOC 2 Type II report assessing security and confidentiality trust services criteriaAnswer
  2. B
    A SOC 2 Type I report covering the relevant trust services criteria and system boundaries
  3. C
    A SOC 3 attestation report covering security and availability principles
  4. D
    An external penetration testing report with executive attestation of remediation

Answer

A SOC 2 Type II report assessing security and confidentiality trust services criteria is the required attestation because it evaluates both control design suitability and operational effectiveness over a specified testing window (e.g., 12 months).
The option specifying a SOC 2 Type II report is correct because Service Organization Control (SOC) 2 Type II reports evaluate both the design suitability and the operational effectiveness of security controls over an extended testing period (typically 6 to 12 months). This directly satisfies the requirement for proof of continuous control operation across a 12-month window.

Step-by-Step Solution

1
Analyze the audit requirements in the scenario.
Identified two key requirements: (1) verification of control design suitability, and (2) proof of operational effectiveness over a continuous 12-month evaluation window.
Determining the scope (point-in-time vs. evaluation period) and depth (detailed testing vs. public summary) is critical for selecting the correct attestation type.
2
Evaluate the distinction between Type I and Type II attestation reports.
Type I reports cover design suitability at a single point in time. Type II reports assess operating effectiveness over a defined evaluation period.
The scenario explicitly specifies a continuous 12-month evaluation window, eliminating point-in-time assessments.
3
Evaluate the distinction between SOC 2, SOC 3, and technical testing reports.
SOC 2 provides the detailed independent auditor evidence required for compliance oversight, whereas SOC 3 is a general public summary and penetration tests are point-in-time technical evaluations.
Only a SOC 2 Type II report meets all conditions of detailed operational testing over a multi-month period.

Key Concept

Distinction between SOC report types (SOC 1 vs SOC 2 vs SOC 3) and report coverage (Type I point-in-time vs Type II operational period effectiveness).
Estimated Time:2m 0s
Rate this question