Exam CCSP topic 1 question 403 discussion

Actual exam question from ISC's CCSP

Question #: 403
Topic #: 1

[All CCSP Questions]

What are SOC 1/SOC 2/SOC 3?

A. Audit reports
B. Risk management frameworks
C. Access controls
D. Software developments

Show Suggested Answer

Suggested Answer: A 🗳️
An SOC 1 is a report on controls at a service organization that may be relevant to a user entity's internal control over financial reporting. An SOC 2 report is based on the existing SysTrust and WebTrust principles. The purpose of an SOC 2 report is to evaluate an organization's information systems relevant to security, availability, processing integrity, confidentiality, or privacy. An SOC 3 report is also based on the existing SysTrust and WebTrust principles, like a SOC 2 report.
The difference is that the SOC 3 report does not detail the testing performed.

by akg001 at May 22, 2022, 2:16 p.m.