A client hands you a "SOC for Cybersecurity" report. Or a vendor does. Or a lender asks your client to produce one. The name looks like SOC 2, the structure partly resembles it, and the audience is different. This is a guide to reading one. If you want the practitioner's view of performing the engagement, see the AICPA cybersecurity risk management examination.
The report has three parts
The AICPA describes the cybersecurity risk management examination as resulting in a report with three key components:
- Management's description. A management-prepared narrative of the entity's cybersecurity risk management program. It explains how the entity identifies its information assets and manages the cybersecurity risks that threaten them.
- Management's assertion. A written assertion by entity management about two matters: whether the description of the program was presented in accordance with the description criteria, and whether the controls within the program were effective in achieving the entity's cybersecurity objectives, based on the control criteria.
- The practitioner's report. The CPA's opinion on those same two matters.
Read them in order, and read the assertion against the description. If management asserts that controls achieved the entity's cybersecurity objectives, the description should tell you what those objectives are.
What the criteria are
The criteria are stated in the report, and the reader should find them early:
- Description criteria: DC section 100, Description Criteria for Management's Description of an Entity's Cybersecurity Risk Management Program, in the AICPA's Description Criteria.
- Control criteria: TSP section 100, the 2017 Trust Services Criteria, where the security, availability and confidentiality criteria are suitable as control criteria.
- Other criteria: suitable criteria other than these may be used for both description and control criteria. If the report names a different framework, the reader should evaluate that choice.
Comparing the SOC reports side by side
The AICPA's comparison of SOC 1, SOC 2 and SOC for Cybersecurity, and the Journal of Accountancy's explanation of SOC 1, 2 and 3, show how they differ.
| SOC 1 | SOC 2 | SOC 3 | SOC for Cybersecurity | |
|---|---|---|---|---|
| Subject | Controls at a service organization relevant to user entities' internal control over financial reporting | Controls at a service organization relevant to security, availability, processing integrity, confidentiality or privacy | A trust services report covering the same subject as SOC 2, without the test detail | An entity's cybersecurity risk management program |
| Who is covered | Service organization | Service organization | Service organization | Any type of organization |
| Responsible party | Service organization management | Service organization management | Service organization management | Entity management |
| Typical users | User entities and their financial statement auditors | Parties with sufficient knowledge of the system | Anyone | General users |
| Use | Restricted | Restricted | Not restricted | Appropriate for general use |
| Includes detailed tests and results | Yes (type 2) | Yes (type 2) | No | Practitioner opinion on description and effectiveness |
Three differences matter most to a reader.
It is entity-level, not system-level. SOC 1 and SOC 2 are generally performed on a system or systems that provide services. A cybersecurity examination is generally performed on the entity-wide program, though scope can be narrowed to a specific system, business unit or function. Check what the report says its boundary is.
Third parties are inside the scope. In a SOC 2, management may use the inclusive method or the carve-out method for a subservice organization. In a cybersecurity examination, entity management is responsible for all controls within the program, whether performed by the entity or a third party, so the description has to cover them.
The audience is broader. A SOC 1 exists for user entities and their auditors. A cybersecurity report is aimed at a broad group of general users, such as a board or lenders. It is also not a financial reporting report.
What you can and cannot take from it
As a financial statement auditor
A cybersecurity report is background on how an entity manages cyber risk. It is not a SOC 1 and does not opine on controls relevant to financial reporting. It does not substitute for your ITGC testing, and it does not tell you whether a given financial reporting control operates. It can sharpen your risk assessment. A description that shows no monitoring of third-party providers, or that cites narrow scope, tells you where to ask questions. The IT audit guide covers what the audit needs.
As a lender, insurer or board member
The report is built for you. Read the practitioner's opinion on the description and on effectiveness, the stated objectives and criteria, and the period or date covered. Ask what was excluded and why.
As a vendor reviewer
If the vendor provides services your client relies on, you will usually want a SOC 1 or SOC 2 for the service itself. Where a vendor provides only a cybersecurity report, ask how its scope relates to the service you consume. SOC 1 vs SOC 2 vs SOC 3: which report and who uses it maps the choice.
A reader's checklist
- Who issued the report, and is the practitioner a CPA firm performing under the AICPA attestation standards?
- What are the entity's cybersecurity objectives, in management's words?
- What is the scope boundary: entity-wide or narrowed?
- Which description criteria and control criteria were used?
- What period or date does it cover, and how does that compare with the period you care about?
- Does the opinion on the description and the opinion on effectiveness both appear unmodified?
- Does the description address third-party-performed controls?
- What changed in the program after the report period?
If a report cannot answer item 2 or 3, it does not tell you much.
What the report does not promise
An opinion that controls were effective in achieving the entity's cybersecurity objectives is not a guarantee against a breach. It speaks to the entity's controls against stated objectives under stated criteria for a stated period. Read it as evidence about the program, not as a warranty about outcomes.
For a related look at how SOC 2 reports are structured, see SOC 2 report anatomy and SOC 2 Type 1 vs Type 2.
Frequently asked questions
Is a SOC for Cybersecurity report the same as a SOC 2?
No. A SOC 2 reports on a service organization's system against its service commitments using trust services criteria. A SOC for Cybersecurity reports on an entity's cybersecurity risk management program and may be issued for any type of organization.
Is it a general-use report?
The AICPA's comparison describes it as appropriate for general use, though the practitioner may decide to restrict use to specified parties.
Does it cover third-party vendors the entity uses?
Yes, to the extent they perform controls within the entity's cybersecurity risk management program. The description criteria require the description to address all controls in the program.
Can an auditor use it instead of a SOC 1?
No. A SOC 1 addresses controls relevant to user entities' internal control over financial reporting. The cybersecurity report addresses a cybersecurity program.
Sources
- AICPA, Illustrative Cybersecurity Risk Management Report (SOC for Cybersecurity): https://www.aicpa-cima.com/resources/download/get-an-illustrative-cybersecurity-risk-management-report
- AICPA, Appendix A: Comparison of SOC 1, SOC 2, and SOC for Cybersecurity Examinations and Related Reports (as published by the U.S. Department of Labor ERISA Advisory Council): https://www.dol.gov/sites/dolgov/files/ebsa/pdf_files/2022-cybersecurity-issues-affecting-health-benefit-plans-blanco-best-written-statement-appendix-a-07-18.pdf
- Center for Audit Quality, CAQ Alert #2017-01 (April 26, 2017): https://www.thecaq.org/caq-alert-2017-01-aicpa-publishes-criteria-evaluate-and-report-cybersecurity
- Journal of Accountancy, "Explaining the 3 faces of SOC" (June 2016): https://www.journalofaccountancy.com/newsletters/2016/jun/3-face-of-soc/
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Completion and reporting: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error