ISC2 Certified Cloud Security Professional (CCSP) Practice Question

A SOC 2 Type I report evaluates whether the cloud provider's controls are suitably designed, but only as of a single point in time. It does not demonstrate that the controls were operating effectively over a period, which is exactly what SOX and most internal audit programs demand. A SOC 2 Type II (or comparable assurance such as an ISAE 3402 Type II) covers both design and operating effectiveness over a defined review period, typically 6-12 months, so it satisfies the requirement. Simply accepting the risk, relying on customer-side compensating controls, or waiting until next year would still leave the compliance gap unresolved.