SOC 1 (System and Organization Controls 1) is a report on the controls at a service organisation that are relevant to its clients' Internal Control over Financial Reporting (ICFR). It is performed under the AICPA's SSAE 18 standard in the United States, with ISAE 3402 as the international equivalent, and the report is issued by an independent licensed CPA firm.
SOC 1 vs SOC 2
| SOC 1 | SOC 2 | |
|---|---|---|
| Focus | Controls affecting clients' financial reporting (ICFR) | Trust Services Criteria: security, availability, processing integrity, confidentiality, privacy |
| Standard | SSAE 18 (ISAE 3402 internationally) | SSAE 18 / Trust Services Criteria |
| Typical users | Client finance teams and their auditors | Client security, procurement and risk teams |
Type I vs Type II
- Type I — the suitability of the design of controls at a specific date.
- Type II — the design and the operating effectiveness of controls over a period, usually 6 to 12 months.
- Type II carries more weight with clients because it tests that controls actually operated.
Who needs a SOC 1 report
- Payroll and benefits processors
- Loan and claims servicers and third-party administrators
- Data centres and colocation / hosting providers
- SaaS platforms that process financial transactions for clients
- Any service organisation whose services could affect a client's financial statements
What the report contains
- Management's description of the system and control objectives.
- The auditor's opinion on fair presentation and, for Type II, operating effectiveness.
- The control objectives, the controls, and (for Type II) the tests and results.
- A restricted-use report — intended for the service organisation, its user entities and their auditors.
How CyberSigma helps
We deliver SOC 1 readiness — defining control objectives, designing and documenting controls, and assembling evidence — so the attestation (issued by a licensed CPA firm) goes smoothly. We also run SOC 2 where clients need both.
Free 1-minute check
Try it free →Free Security Assessment
Get a complimentary, no-obligation assessment from CERT-In empanelled senior auditors.
Frequently asked questions
What is SOC 1?
SOC 1 is a System and Organization Controls report on a service organisation's controls relevant to its clients' internal control over financial reporting, performed under SSAE 18 (ISAE 3402 internationally) and issued by a licensed CPA firm.
What is the difference between SOC 1 and SOC 2?
SOC 1 covers controls affecting clients' financial reporting; SOC 2 covers the Trust Services Criteria — security, availability, processing integrity, confidentiality and privacy. Some organisations need both.
What is the difference between SOC 1 Type I and Type II?
Type I assesses the design of controls at a point in time; Type II also tests their operating effectiveness over a period, typically 6 to 12 months.
Who needs a SOC 1 report?
Service organisations whose services could affect their clients' financial statements — payroll processors, loan and claims servicers, data centres, and SaaS handling financial transactions.
CyberSigma services
Official documents
CyberSigma resources
Free download
Free compliance toolkits
Checklists, evidence registers and policy templates our auditors actually use on engagements.
Free compliance toolkits
Enter your work email and we’ll unlock the Excel + PDF instantly.
Need help with SOC 1?
CERT-In empanelled, PCI QSA senior auditors can take you from reading about it to compliant — with a scoped, guided programme.