Examkin

Soru

Zorluk: OrtaSecurity Audits, Assessments, and Attestations

A security analyst at a financial institution is conducting a vendor risk assessment for a prospective software-as-a-service (SaaS) human resources platform. The vendor provides a SOC 1 Type II report to demonstrate financial reporting integrity. However, the analyst must verify the operational effectiveness of the vendor's data encryption, system availability, and confidentiality controls over the past 12 months. Which attestation deliverable should the analyst request from the vendor?

  1. SOC 2 Type II reportCevap
  2. B
    SOC 1 Type I report
  3. C
    SOC 2 Type I report
  4. D
    SOC 3 report

Cevap

The analyst should request a SOC 2 Type II report.
A SOC 2 Type II report assesses a service organization's controls based on the AICPA Trust Services Criteria (security, availability, processing integrity, confidentiality, and privacy) and verifies their operational effectiveness over a sustained period of time (typically 6 to 12 months).

Adım Adım Çözüm

1
Identify the evaluation scope required by the analyst.
The requirement focuses on data encryption, system availability, and confidentiality controls (Trust Services Criteria), not internal controls over financial reporting.
This rules out SOC 1 reports, which focus exclusively on financial reporting controls.
2
Determine the time period requirement for the evaluation.
The requirement calls for verifying operational effectiveness over the past 12 months (a specified period).
Type I reports only assess design suitability at a single point in time, whereas Type II reports test operational effectiveness over a period of time.
3
Select the deliverable that contains detailed technical testing results.
A SOC 2 Type II report provides detailed testing procedures, results, and operational effectiveness evaluation for security criteria over a period.
SOC 3 reports are high-level summary documents intended for public distribution and lack the detailed technical testing evidence needed for vendor security vetting.

Anahtar Kavram

SOC 2 Type II Attestation Reports
Bu soruyu puanla

Konular

Security Audits, Assessments, and Attestations

Bu konudan daha fazla soru