SOC for Cybersecurity is the AICPA's name for an examination of an entity's cybersecurity risk management program. A CPA reports on two things: whether management's description of the program is presented in accordance with a set of description criteria, and whether the controls within the program were effective in achieving the entity's cybersecurity objectives, measured against control criteria. The description criteria are DC section 100, Description Criteria for Management's Description of an Entity's Cybersecurity Risk Management Program, published in the AICPA's Description Criteria.
SOC 1, SOC 2 and SOC 3 are all about a service organization. SOC for Cybersecurity is different in who can use it and what it covers. This page sets out the structure of the engagement and the points a firm settles before accepting one. It paraphrases AICPA material. The AICPA's guide, Reporting on an Entity's Cybersecurity Risk Management Program and Controls, and the criteria documents are the authority.
What is a SOC for Cybersecurity examination?
It is an examination engagement, so it sits in the attestation standards, with AT-C 105 and AT-C 205 as the base sections. See the SSAE 18 overview for how the AT-C sections fit together. The responsible party is entity management, not a service organization.
The AICPA's comparison of the SOC examinations describes the subject matter as two items: the description of the entity's cybersecurity risk management program based on the description criteria, and the effectiveness of controls within that program to achieve the entity's cybersecurity objectives based on the control criteria.
Three features separate it from SOC 2:
- Any type of organization. SOC 1 and SOC 2 are for service organizations. A SOC for Cybersecurity examination can be performed for any organization.
- Entity-wide by default. The examination is generally performed on an entity-wide program, although the scope may be narrowed to a specific system, business unit or function.
- General use. The report is described as appropriate for general use, meaning its use is not restricted to specified parties. The AICPA guide notes that a practitioner may still decide to restrict the use of a report to specified parties.
What are the DC 100 description criteria?
DC 100 sets what management's description must cover. The AICPA publishes the criteria in nine groups, summarized here in paraphrase:
| Area | What the description addresses |
|---|---|
| Nature of business and operations | What the entity does and the operations the program protects |
| Nature of information at risk | The kinds of sensitive information exposed to cybersecurity risk |
| Program objectives | The entity's cybersecurity objectives |
| Inherent risk factors | Factors that significantly affect the entity's inherent cybersecurity risks |
| Governance structure | How cybersecurity risk is overseen and who is accountable |
| Risk assessment process | How cybersecurity risks are identified and assessed |
| Communications | How cybersecurity information is communicated internally and externally |
| Monitoring | How the program is monitored and deficiencies are addressed |
| Control processes | The controls and processes that respond to the assessed risks |
The AICPA's comparison notes one structural point. In a SOC 2, management can carve out a subservice organization. In the cybersecurity examination, entity management is responsible for all controls within the program, whether the entity or a third party performs them, so the description has to address all of them.
What are the control criteria?
The control criteria are the yardstick for the second opinion. The AICPA names the Trust Services Criteria in TSP section 100 (2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy, with revised points of focus, 2022) as suitable control criteria for security, availability and confidentiality. Suitable criteria other than those the AICPA outlines may also be used for both the description and the controls.
Where management chooses other criteria, the practitioner must still conclude, as for any examination, that the criteria are suitable and available to the intended users.
What does the report contain?
The components in the AICPA's comparison are:
- A description of the entity's cybersecurity risk management program.
- A written assertion by entity management about whether the description was presented in accordance with the description criteria and whether controls within the program were effective in achieving the entity's cybersecurity objectives based on the control criteria.
- A practitioner's report with an opinion on the same two matters.
The report contains two opinions, one on the description and one on control effectiveness. A qualified opinion on one can stand beside an unmodified opinion on the other, so readers need to look at both.
An illustrative scoping conversation
A regional logistics company with a board that wants outside comfort asks a firm about a SOC for Cybersecurity examination. The firm works through the following before it quotes a fee.
- Scope. Entity-wide is the default. The company asks to limit it to the dispatch platform and the warehouse systems. A narrower scope is allowed, but the description must state the scope, and readers will see that the rest of the entity is outside it.
- Third parties. The company runs dispatch on a cloud platform and outsources its help desk. Under DC 100 the description has to cover the controls over those services, because the entity answers for the whole program. Management needs access to the providers' evidence, including any SOC reports they hold.
- Criteria. The company has not picked control criteria. Management selects them, and the firm confirms they are suitable before accepting.
- Readers. The report will go to lenders and insurers. General use means no use restriction in the report, so the engagement letter and management's assertion need to be accurate for readers the firm will never meet.
- Independence. An examination is an attest engagement, so the independence requirements of the AICPA Code apply. If the firm helped build the program, the nonattest services evaluation comes first. See independence and nonattest services.
SOC for Cybersecurity, SOC 2 and SOC 3 compared
| SOC 2 | SOC 3 | SOC for Cybersecurity | |
|---|---|---|---|
| Entities | Service organizations | Service organizations | Any organization |
| Level | System | System | Entity-wide, scope may be narrowed |
| Responsible party | Service organization management | Service organization management | Entity management |
| Description criteria | DC 200 | Brief system attachment, not the full SOC 2 description | DC 100 |
| Control criteria | Trust Services Criteria | Trust Services Criteria | Trust Services Criteria or other suitable criteria |
| Report use | Restricted to knowledgeable parties | General use | General use |
The SOC 2 and SOC 3 columns follow the AICPA comparison and the SOC 3 page. See also SOC 1 vs SOC 2 vs SOC 3.
What should a financial statement auditor take from this?
A SOC for Cybersecurity report is not a SOC 1 report. It is not designed to give a user auditor evidence about controls over financial reporting. A financial statement auditor reading one learns about the entity's cybersecurity program and may use it as context for the risk assessment, including cybersecurity risk and IT general controls. Evidence about ICFR still comes from procedures designed for that purpose.
Frequently asked questions
What is DC 100?
DC section 100 is the AICPA's description criteria for management's description of an entity's cybersecurity risk management program. Management prepares its description against these criteria, and the practitioner opines on whether the description is presented in accordance with them.
Who can receive a SOC for Cybersecurity report?
The AICPA describes it as appropriate for general use, so use is not restricted to specified parties. A practitioner can decide to restrict use in a particular report.
Is a SOC for Cybersecurity the same as a SOC 2?
No. A SOC 2 reports on a service organization's system against the trust services criteria and is restricted-use. A SOC for Cybersecurity reports on an entity-wide cybersecurity risk management program and is general-use.
Do the Trust Services Criteria apply?
They can serve as the control criteria. The AICPA identifies the security, availability and confidentiality criteria as suitable for that purpose, and other suitable criteria may be used.
Can the examination cover only part of the entity?
Yes. The scope may be narrowed to a specific system, business unit or function, and the description should say so.
Sources
- AICPA, Appendix A: Comparison of SOC 1, SOC 2, and SOC for Cybersecurity Examinations and Related Reports, reproduced in written testimony to the U.S. Department of Labor ERISA Advisory Council: dol.gov
- AICPA, DC section 100, Description Criteria for Management's Description of an Entity's Cybersecurity Risk Management Program, AICPA Description Criteria
- AICPA, TSP section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (With Revised Points of Focus - 2022)
- AICPA, Reporting on an Entity's Cybersecurity Risk Management Program and Controls (guide)
- AICPA Professional Standards, AT-C sections 105 and 205
- AICPA, SOC suite of services overview: aicpa-cima.com
Related
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error