Definition
SOC for Cybersecurity is an examination engagement under AT-C 105 and AT-C 205. The practitioner reports on two things: whether management's description of its cybersecurity risk management program is presented in accordance with the DC section 100 description criteria, and whether controls within the program were effective to achieve the entity's cybersecurity objectives, based on suitable control criteria such as the trust services criteria. Unlike SOC 1 and SOC 2, it is not limited to service organizations.
Why it matters in an audit or review
A financial statement auditor does not need this report to complete an audit. It becomes relevant when management, a board or a lender wants independent assurance over cyber risk management, and when the auditor reads it to understand risks arising from IT.
Example
Illustrative: a manufacturer with no outsourced services engages a CPA firm for an entity-wide SOC for Cybersecurity examination to give its board and lender a common view of the program. A SOC 2 would not fit, because the company is not a service organization.
Common mistakes
- Confusing it with a SOC 2, which covers a service organization's system and is based on the trust services criteria.
- Expecting it to opine on whether the entity has been breached.
Sources
- AICPA, DC Section 100, Description Criteria for Management's Description of an Entity's Cybersecurity Risk Management Program
- AICPA, Guide: Reporting on an Entity's Cybersecurity Risk Management Program and Controls
- AICPA, SOC for Cybersecurity overview, https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error