What is SOC for Cybersecurity?
In short
A System and Organization Controls (SOC) for Cybersecurity examination reports on the description of an organization's cybersecurity risk management program and whether its controls were effective in meeting its cybersecurity objectives.
Key takeaways
- Any organization can have one, not just service organizations.
- The report is general use, suited to boards, investors and business partners.
- It complements SOC 2 reports, which focus on services provided to customers.
Where it's tested
ISC: System and Organization Controls (SOC) Engagements — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
A company wants a general-use report on its entity-wide cybersecurity risk management program, not just one system it provides to customers. Which report fits best?