A customer's security team needs a detailed, restricted-use report from an independent auditor on a SaaS provider's controls relevant to security, availability and confidentiality, rather than controls relevant to the customer's financial reporting. Which report should it request?
Select an answer to reveal the explanation.
Short Explanation
Think of the SOC family like this: SOC 1 is for the finance auditors, SOC 2 is the detailed security report you get under NDA and SOC 3 is the public brochure version. Security, availability and confidentiality plus restricted use points straight at SOC 2. ISAE 3402 is the international cousin of SOC 1, so it's the wrong family member here.
Full Explanation
SOC 2 examinations report on a service organization's controls relevant to the AICPA trust services criteria: security, availability, processing integrity, confidentiality and privacy. The report includes a detailed system description, the auditor's opinion and, for Type II, the tests performed and results, and it is intended for restricted use by parties with sufficient knowledge, such as customers under nondisclosure. That matches a security team that needs detail on security, availability and confidentiality controls. A SOC 1 report addresses controls at a service organization relevant to user entities' internal control over financial reporting, so it serves financial statement auditors rather than security due diligence. A SOC 3 report covers the same trust services criteria as SOC 2 but is a general-use summary without the detailed description of tests and results, so it lacks the depth required. An ISAE 3402 report is the international assurance standard for controls at a service organization relevant to financial reporting, the counterpart of SOC 1, and therefore does not target the trust services criteria. Exam caveat: confirm whether the report is Type I or Type II and which criteria and services are in scope. Operational check: verify the report period, the systems described, any carved-out subservice organizations and the complementary user entity controls the customer must perform.