ISC2 Certified Cloud Security Professional (CCSP) Practice Question

A SOC 2 Type II report is performed under SSAE 18 (or ISAE 3000) and addresses the Trust Services Criteria-security, availability, processing integrity, confidentiality, and privacy. A Type II opinion evaluates both the design and operating effectiveness of controls during a review period (usually 6-12 months) and contains detailed test procedures and results, making it suitable for user entities and their auditors under NDA.

A SOC 1 Type I focuses solely on controls relevant to financial reporting and only evaluates design at a single point in time. A SOC 3 report is a public, high-level summary that omits the detailed testing your risk committee needs. An ISO/IEC 27001 certificate indicates that an ISMS meets the standard's requirements but does not provide an auditor's description of tests or results, nor is it scoped specifically to the Trust Services Criteria.