Exam CISSP topic 1 question 169 discussion

Soc 2 for sure

SOC1 it is only financial... it is SOC2

SSAE 18 is the standard, which is what the question is looking for.

SSAE 18 seems to be the answer here: https://reciprocity.com/resources/what-is-a-ssae-18-audit/

ugh I really dont like questions like this. Technically based on the wording the true answer is that it would be SSAE 18 as this defines how the SOC reports are generated. But the question is would a CEO/manager give a shit what standard was being using or would they just want the SOC 2 report

The question is asking about an auditing standard SSAE 18 is a standard. SOC 1 an 2 are reports.. and SOC reports are defined in the SSAE 18

Answer A) Service Organization Control (SOC) 2 The other three refer to financial standards. https://ssae-16.com/soc-1/#:~:text=The%20SOC1%20Report%20is%20what,of%20May%201%2C%202017).

B. Soc is not a standard

SOC 2 is a voluntary compliance standard for service organizations,

It is A.

Answer is B, the question clearly states "standard". The SSAE 18 is a standard that is used to generate the SOC2 report. "The Statement on Standards for Attestation Engagements 18, or SSAE 18, is a standard that auditors can use to review the controls of technology vendors and other service providers so that businesses using those vendors can be confident that the vendors’ controls-particularly those related to cybersecurity" https://reciprocity.com/understanding-ssae-18-requirements/

CISSP Official Study Guide pg 729 - "SOC 2 Engagements Assess the organization's controls that affect the security (confidentiality, integrity, and availability) and privacy of information stored in a system. SOC 2 audit results are confidential and are normally only shared outside the organization under an NDA."

Why A? SOC2 should be confidential

B (SSAE) would be correct. Reference : https://www.advancedbusinesssolutions.com/whats-a-soc-compliant-service-provider/

Select A, SOC 1 is about the financial report?

Definitely A... SOC 2 provides, CIA + Privacy + Process Integrity + Security (Data Loss etc.)

B. The question asks "security audit standard". Among the 4 answers, only ssae 18 is a Generally Accepted Auditing Standard. SOC1, SOC2 and SAS70 are all report types. https://www.esgthereport.com/what-are-ssae-18-standards/ SSAE 18 is an AICPA standard that provides guidelines for evaluating the effectiveness of information security, availability, processing integrity, confidentiality, and privacy controls in cloud computing services.