Examkin

Question

Difficulty: MediumSecurity Audits, Assessments, and Attestations

A security analyst at a financial institution is conducting a vendor risk assessment for a prospective software-as-a-service (SaaS) human resources platform. The vendor provides a SOC 1 Type II report to demonstrate financial reporting integrity. However, the analyst must verify the operational effectiveness of the vendor's data encryption, system availability, and confidentiality controls over the past 12 months. Which attestation deliverable should the analyst request from the vendor?

  1. SOC 2 Type II reportAnswer
  2. B
    SOC 1 Type I report
  3. C
    SOC 2 Type I report
  4. D
    SOC 3 report

Answer

The analyst should request a SOC 2 Type II report.
A SOC 2 Type II report assesses a service organization's controls based on the AICPA Trust Services Criteria (security, availability, processing integrity, confidentiality, and privacy) and verifies their operational effectiveness over a sustained period of time (typically 6 to 12 months).

Step-by-Step Solution

1
Identify the evaluation scope required by the analyst.
The requirement focuses on data encryption, system availability, and confidentiality controls (Trust Services Criteria), not internal controls over financial reporting.
This rules out SOC 1 reports, which focus exclusively on financial reporting controls.
2
Determine the time period requirement for the evaluation.
The requirement calls for verifying operational effectiveness over the past 12 months (a specified period).
Type I reports only assess design suitability at a single point in time, whereas Type II reports test operational effectiveness over a period of time.
3
Select the deliverable that contains detailed technical testing results.
A SOC 2 Type II report provides detailed testing procedures, results, and operational effectiveness evaluation for security criteria over a period.
SOC 3 reports are high-level summary documents intended for public distribution and lack the detailed technical testing evidence needed for vendor security vetting.

Key Concept

SOC 2 Type II Attestation Reports
Rate this question

Topics

Security Audits, Assessments, and Attestations

More questions from this topic