Exam CCSP topic 1 question 108 discussion

the question doesn't seem correct The SOC 2 Type 1 is not extremely useful for determining the security and trust of an organization. The SOC 2 Type 1 only reviews the design of controls, not how they are implemented and maintained, or their function. The SOC 2 Type 2 report, however, does just that. This is why the SOC 2 Type 2 is the sort of report that is extremely useful for getting a true assessment of an organization’s security posture.

SOC Type 1 reports are often intended for restricted use, meaning they are designed for specific, intended users, such as management or those charged with governance, not for the general public or broader external use. They evaluate the design of a service organization's controls at a specific point in time.

SOC2 TYPE 2

SSAE-16 includes SOC1 and SOC2. Both are restricted. "SSAE-16, which stands for Statement on Standards for Attestation Engagements No. 16, was introduced by the AICPA as a replacement for SAS-70. SSAE-16 introduced several changes and improvements to the auditing and reporting process for service organizations, particularly for those providing services that could impact their clients' financial reporting. SSAE-16 is part of a broader framework for attestation engagements, including SOC (Service Organization Control) reports (SOC1 and SOC2)."

You may get type 2 reports, but never type 1 report (soc 1 or 2 does not matter). Type 1 reports are always classified with no exceptions in real life since it pertains to a “specific time” as against type 2. Ask any auditor friend, they will tell.

SOC Type 2 reports include a description of the service organization's system, a detailed testing of the design and operating effectiveness of controls, and an opinion provided by an independent auditor.

SOC 2 Type 2 is the correct answer.

Type 1 report just provides a report of procedures / controls an organization has put in place as of a point in time (no required audit so no outside audience; i.e., more restrictive). A Type 2 report has an audit period and provides evidence of how an organization operated its controls over a period of time (required audit so outside audience; i.e., less restrictive). Restrictive is observed from the perspective of the data owner's view.

A SOC Type 2 audit report is considered a "restricted use" report for its intended audience. SOC, or Service Organization Controls, is a set of auditing standards and guidelines developed by the American Institute of Certified Public Accountants (AICPA) to help service organizations demonstrate the effectiveness of their internal controls and processes. A SOC Type 2 audit report is a detailed assessment of a service organization's controls over a specific period of time, typically six to nine months. Because this report contains sensitive information about the organization's internal controls and processes, it is considered a "restricted use" report and is only intended for the organization's management, board of directors, and other stakeholders who have a need to know the information contained in the report.

Yes it is D

Request to update the choices as both "SOC Type 1" and "SOC Type 2" (whether SOC1 or SOC2) are both restricted to their intended users. Also SOC3 (which does not have any type) are for public use.

Note that it does not mention SOC 1 or SOC 2, but Type 1 & Type 2. There is something worng with this question. Type 2 is in a period of time - 6 months Type 1 is in a specific time, when the control/design was checked.

both are restricted but SOC1 is more restrictive SOC 1 - Use of these reports is restricted to the management of the service organization, user entities, and user auditors. SOC 2 - Use of these reports are restricted. Taken from https://us.aicpa.org/interestareas/frc/assuranceadvisoryservices/serviceorganization-smanagement

SOC 2 is the right answer

They mean SoC 1 which is true, which is a control report that focuses strictly on an organization’s financial statements and a service organization’s controls that can impact a customer’s financial statements

The options include SOC Type I & II, not SOC 2 Type II. SOC Type I - provides a description of the controls provided by the audited organization and the auditor opinion based on the description, BUT... does not involve actual testing of controls. SOC Type 1 reports are intended for restricted use, only to be seen by the actual service organization, its current clients, or its auditors. These reports are not intended for wider or public distribution. So, the answer is correct folks.

SOC2 Type 2 is the correct answer