CISSP: Certified Information Systems Security Professional

Question

When performing a third-party risk assessment of a new supplier, which of the following reports should be examined to verify the operating effectiveness of the security, availability, confidentiality, and privacy trust principles?

Explanation

A SOC 2 Type 2 report evaluates controls relevant to the Trust Services Criteria and provides assurance about their operating effectiveness over a specified period. The relevant criteria include security, availability, confidentiality, and privacy. SOC 1 instead focuses on controls relevant to user entities’ internal control over financial reporting.

Learn more

AICPA & CIMA — SOC 2 Reporting on an Examination of Controls

CISSP: Certified Information Systems Security Professional

AstroTutor

Notes

Readiness

QuestionQ197

Community Discussion