Examkin

Question

Difficulty: MediumSecurity Audits, Assessments, and Attestations

A fintech enterprise developing a cloud-native payment gateway is undergoing a third-party risk assessment by a prospective banking partner. The partner demands verified proof that security, confidentiality, and availability controls were not only properly designed but also maintained operational effectiveness throughout the preceding nine months. Which attestation report should the fintech enterprise provide to satisfy this requirement?

  1. SOC 2 Type II reportAnswer
  2. B
    SOC 2 Type I report
  3. C
    SOC 1 Type II report
  4. D
    SOC 3 report

Answer

SOC 2 Type II report
A SOC 2 Type II report evaluates whether specified controls were designed appropriately and operated effectively over an extended period (typically 6 to 12 months) based on the AICPA Trust Services Criteria (security, availability, confidentiality, processing integrity, and privacy).

Step-by-Step Solution

1
Identify the focus criteria of the audit requirement.
The requirement specifies security, confidentiality, and availability, which fall under the AICPA Trust Services Criteria (SOC 2), not financial reporting (SOC 1).
Matching the assessment scope to the correct report family ensures the audit covers the required technical domains.
2
Determine the time horizon and testing requirement.
The requirement demands proof of operational effectiveness over a nine-month period, which requires a Type II report.
Type I reports cover a single point in time, whereas Type II reports evaluate control execution across a defined monitoring period.
3
Select the report type matching both criteria.
A SOC 2 Type II report provides detailed auditor testing results for operational effectiveness over time for Trust Services Criteria.
This report fulfills both the technical domain and the temporal duration requirements set by the banking partner.

Key Concept

SOC Report Types and Attestation Scopes
Rate this question

Topics

Security Audits, Assessments, and Attestations

More questions from this topic