Security audits, SOC 1 / 2 / 3 reports, and Type 1 vs Type 2 evidence

AICPA System and Organization Controls: SOC 1, SOC 2, and SOC 3

When an organization relies on a service provider (such as an IaaS cloud, payroll processor, or SaaS platform), it cannot send its own employees into the vendor’s datacenter every week. Instead, independent Certified Public Accountant (CPA) firms conduct System and Organization Controls (SOC) examinations under AICPA SSAE 18 (and international standard ISAE 3402).

Each SOC number serves a distinct purpose and audience. A SOC 1 report evaluates controls at a service organization that are relevant to a user entity’s Internal Control over Financial Reporting (ICFR - for example, a loan servicing or payroll provider whose calculations feed directly into a public company’s SOX financial statements).

A SOC 2 report is the workhorse of cybersecurity assurance: it evaluates a service organization’s controls against up to five Trust Services Criteria (TSC): Security (the mandatory Common Criteria foundation), Availability, Processing Integrity, Confidentiality, and Privacy. Because a SOC 2 report lists exact control descriptions, test procedures, and any exceptions (failures) found by the auditor, it is a restricted-use document shared with customers and auditors under a Non-Disclosure Agreement (NDA). A SOC 3 report covers the exact same five Trust Services Criteria as a SOC 2 Type 2, but strips out the confidential control details and test matrices so the vendor can publish the summary report openly on its public website.

Type 1 vs Type 2 depth and reading the auditor’s opinion

Both SOC 1 and SOC 2 come in two depth variants: Type 1 and Type 2. A Type 1 examination assesses whether management’s description of the system is fairly presented and whether the controls are suitably designed to meet the control objectives as of a single specified date (for example, "as of October 14, 2026"). A Type 1 report does NOT test whether employees actually followed those controls last month.

A Type 2 examination assesses fairness of description, suitability of design, AND the operating effectiveness of those controls over a defined review period (typically 6 to 12 months). To prove operating effectiveness, the auditor samples change tickets, onboarding records, access revocations, and vulnerability remediation logs across the entire window.

When reading a SOC 2 Type 2 report, never stop at the cover page. Check four sections: first, the Scope and Complementary User Entity Controls (CUECs - controls the vendor assumes YOU, the customer, have configured, such as enabling MFA on your tenant); second, the Auditor’s Opinion (Unqualified/Unmodified means "clean"; Qualified means specific material exceptions occurred; Adverse means controls failed pervasively; Disclaimer means the auditor could not obtain enough evidence); third, which of the 5 Trust Services Criteria were actually included; and fourth, Section 4’s detailed test exceptions.

NIST SP 800-53A assessment methods and auditor independence

Under NIST SP 800-53A and ISO/IEC 19011, assessors verify controls using three complementary methods against assessment objects: Examine (reviewing specifications, policies, architecture diagrams, logs, and configuration files), Interview (questioning personnel across roles to verify awareness and actual practice), and Test (exercising mechanisms - such as running a failover drill or attempting an unauthorized API call - to observe real behavior).

For any audit (First-Party internal audit, Second-Party customer-on-supplier audit, or Third-Party independent certification audit) to be credible, Governance must protect Auditor Independence and Objectivity. An engineer who designed, built, or operates the firewall rules at chronos.orbital must never be the sole auditor signing off on the effectiveness of those firewall rules, and internal audit should report functionally to the Board Audit Committee rather than the IT operations chain.