{"id":1561,"date":"2011-08-19T00:00:00","date_gmt":"2011-08-19T00:00:00","guid":{"rendered":"http:\/\/otava.test\/soc-1-soc-2-soc-3-report-comparison\/"},"modified":"2011-08-19T00:00:00","modified_gmt":"2011-08-19T00:00:00","slug":"soc-1-soc-2-soc-3-report-comparison","status":"publish","type":"post","link":"https:\/\/www.otava.com\/blog\/soc-1-soc-2-soc-3-report-comparison\/","title":{"rendered":"Service Organization Control Reports: SOC 1, SOC 2 & SOC 3"},"content":{"rendered":"

In April 2010, the AICPA (American Institute of Certified Public Accountants) announced the replacement of SAS 70 by a new and refined auditing standard, the Statement on Standards for Attestation Engagements or SSAE 16<\/a>. While SAS 70 was originally intended for financial and accounting auditing, the SSAE 16 audit was established to verify data center operational and security excellence.<\/p>\n

In addition to SSAE 16<\/a>, three new reports have also been established as the framework for examining controls at a service organization, aptly named Service Organization Control (SOC) reports. While the SOC 1 report is mainly concerned with examining controls over financial reporting, the SOC 2<\/a> and SOC 3<\/a>\u00a0reports focus more on the pre-defined, standardized benchmarks for controls related to security, processing integrity, confidentiality, or privacy of the data center\u2019s system and information. SOC 2 examines the details of data center testing and operational effectiveness. According to AICPA.org, these reports are very in-depth and useful for:<\/p>\n