Examkin

Soru

Zorluk: ZorSecurity Audits, Assessments, and Attestations

An enterprise software company is evaluating an independent third-party attestation for a cloud hosting vendor that processes non-financial sensitive customer data. The enterprise compliance manager mandates that the assessment must verify the operational effectiveness of security, confidentiality, and availability controls over a continuous six-month observation window, while excluding internal controls over financial reporting (ICFR). Which TWO of the following statements correctly describe the attestation report types or evaluation criteria that satisfy these requirements? (Select TWO.)

  1. A SOC 2 Type II report must be specified because it evaluates the operational effectiveness of controls over a designated testing period.Cevap
  2. The audit scope must be aligned with the Trust Services Criteria rather than Internal Control over Financial Reporting (ICFR).Cevap
  3. C
    A SOC 1 Type II report should be requested because SOC 1 is the standard attestation framework for non-financial operational security controls over an extended period.
  4. D
    A SOC 2 Type I report should be requested because Type I reports provide empirical audit evidence of control performance across a minimum six-month timeframe.

Cevap

The organization must request a SOC 2 Type II report aligned with the Trust Services Criteria. A SOC 2 Type II report assesses operational control effectiveness over a continuous observation period, while Trust Services Criteria evaluate non-financial security, confidentiality, and availability principles.
Selecting a SOC 2 Type II report fulfills the requirement because Type II reports evaluate operational control effectiveness over a designated time period (such as six months). Furthermore, aligning the evaluation with the Trust Services Criteria ensures focus on security, availability, and confidentiality rather than financial reporting controls.

Adım Adım Çözüm

1
Differentiate between SOC 1 and SOC 2 scope objectives.
SOC 1 evaluates controls relevant to Internal Control over Financial Reporting (ICFR), whereas SOC 2 evaluates controls against the Trust Services Criteria (Security, Availability, Confidentiality, Processing Integrity, and Privacy). Since financial reporting is excluded, SOC 2 and Trust Services Criteria are required.
Matching audit scope to business requirements prevents requesting irrelevant financial control attestations.
2
Differentiate between Type I and Type II report types.
Type I reports evaluate control design suitability at a single point in time. Type II reports evaluate operational effectiveness over a specified observation period (minimum six months).
The requirement specifically calls for verifying control performance over a six-month window.

Anahtar Kavram

Distinction between SOC report types (SOC 1 vs. SOC 2) and report options (Type I vs. Type II)
Bu soruyu puanla

Konular

Security Audits, Assessments, and Attestations

Bu konudan daha fazla soru