ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

A SOC 2 Type II report is produced by an independent auditor and covers both the design and operating effectiveness of a service provider's controls over a defined period (typically 6-12 months). Because it evaluates whether the controls functioned as intended during that period, it offers strong, time-bound assurance that satisfies an annual supplier risk review.

An ISO/IEC 27001 certificate demonstrates that an organization's information security management system met the standard at the time of certification, but it does not provide the same depth of evidence about control operation over the past year and is valid for up to three years. An internal whitepaper and a marketing brochure are self-generated materials; they are neither independent nor comprehensive assessments of control effectiveness, so they offer limited assurance for risk review purposes.