Exam CCSP topic 1 question 451 discussion

A SOC 2 (System and Organization Controls 2) audit reviews an organization’s controls for assuring the confidentiality, integrity, and availability of data. It is based on the AICPA's Trust Services Criteria (TSC), which include: Security Availability Processing Integrity Confidentiality Privacy SOC 2 reports are typically used by cloud service providers (CSPs), SaaS companies, and data processors to demonstrate compliance with security and data protection requirements. Why Not the Others? A. SOC 1 → Focuses on financial reporting controls, not IT security or data protection. C. SOC 3 → A publicly available summary of a SOC 2 report but without detailed security controls. D. SOC 4 → Does not exist in the SSAE auditing framework.

B. SOC 2