Framework Assurance Reports
SOC for Cybersecurity is an AICPA examination in which a CPA reports on an organization's enterprise-wide cybersecurity risk management program rather than on a specific service delivered to customers. It was introduced in 2017 and is the one SOC examination designed for any organization, not just service providers.
The report is general use and can be shared with boards, investors, insurers, regulators and business partners.
The organization must write a description of its cybersecurity risk management program that satisfies the AICPA description criteria (nature of the business, information assets, governance, risk assessment, control processes, monitoring), and it must select control criteria (commonly the Trust Services Criteria, but NIST CSF or ISO 27001/27002 are permitted) against which the CPA evaluates whether the controls were effective.
Written governance, risk assessment and control documentation is therefore the backbone of the engagement.
Voluntary. Used by organizations that want independent assurance over the whole security program to show boards, investors, cyber insurers or customers. No statute or contract standard requires it by name.
Program description written to the description criteria; management assertion; governance documents (board reporting, policies, roles); risk assessment and asset inventory; control inventory mapped to the selected control criteria; evidence of control operation over the period (access reviews, vulnerability management, incident records, awareness training, vendor management); monitoring and remediation records.
Assessors
A licensed CPA firm performing the examination under the AICPA attestation standards. Accredited by State board CPA licensure and the AICPA peer review program. No scheme-level accreditor.
No firm has claimed a SOC for Cybersecurity assessor listing yet. Claim yours →
Consultants
A readiness ecosystem exists among cybersecurity advisory firms and CPA advisory arms: drafting the program description to the description criteria, mapping controls to the chosen control criteria, running gap assessments and preparing evidence. Engagements typically run a readiness phase then the examination.
Firms that name this framework in their own material. Listings we have not verified yet come from public filings and partner lists. Each firm can confirm its own.
Software
Tools that name this framework in their own material.
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Not sure where to start?
Tell us what you are trying to put in place. We will point you to the right tool, a consultant who can implement it, or both.