Reporting on SOC for Cybersecurity Engagements and Cyber Risk Management Programs

SOC for Cybersecurity is an attestation engagement over an entity’s cybersecurity risk management program. It is not a financial statement audit, not a penetration test, and not a guarantee that no breach will occur. The practitioner evaluates management’s description and whether controls were suitably designed and operated effectively to achieve the entity’s cybersecurity objectives.

For AUD, the key is to distinguish SOC for Cybersecurity from SOC 1 and SOC 2. SOC 1 is tied to controls relevant to user entities’ internal control over financial reporting. SOC 2 reports on controls at a service organization using trust services criteria. SOC for Cybersecurity is broader: it addresses an entity-wide cybersecurity risk management program.

    flowchart TD
	    A["Management cybersecurity risk management program"] --> B["Management prepares description"]
	    B --> C["Management makes assertion"]
	    C --> D["Practitioner evaluates description criteria"]
	    C --> E["Practitioner tests controls against suitable criteria"]
	    D --> F["Opinion on whether description is presented in accordance with criteria"]
	    E --> G["Opinion on whether controls were suitably designed and operated effectively"]
	    F --> H["SOC for Cybersecurity report"]
	    G --> H

What the Engagement Covers

The report provides assurance on the cybersecurity risk management program as described. It does not certify that every cyber risk has been eliminated.

Description and Assertion

Management is responsible for the cybersecurity risk management program, the description, and the assertion. The practitioner examines management’s presentation and controls.

If management’s description omits important parts of the program or describes controls that do not exist, the practitioner must evaluate the reporting effect.

Criteria and Control Testing

SOC for Cybersecurity uses suitable criteria for the description and for control evaluation. Trust Services Criteria are commonly relevant to security-oriented control evaluation.

Testing design asks whether the control is capable of achieving the objective. Testing operating effectiveness asks whether the control operated as designed during the period.

Report Types and Users

SOC for Cybersecurity can be useful to boards, investors, customers, regulators, business partners, or other stakeholders who need a structured view of the entity’s cyber risk management program.

The report should balance transparency with security. It should provide enough information for users to understand the program and opinion without unnecessarily revealing exploitable details.

Comparison With Other SOC Reports

Do not choose SOC for Cybersecurity when the fact pattern asks about a payroll processor’s controls relevant to a user entity’s financial statements. That is usually SOC 1 territory.

Reporting Problems

The engagement does not become clean because management has a cybersecurity program. The report depends on whether the description is fair and controls meet the criteria.

Exam Traps

• SOC for Cybersecurity is not SOC 1 and is not primarily about user entities’ ICFR.
• It is not a penetration test or guarantee that no cyber breach will occur.
• Management is responsible for the cyber risk management program, description, assertion, and controls.
• The practitioner provides an attestation opinion based on suitable criteria and evidence.
• Design effectiveness and operating effectiveness are different conclusions.
• A high-level report should not omit information necessary for the description to be fair.
• Cybersecurity assurance can be useful to stakeholders, but it does not replace the financial statement audit.

Quick Review

Use this sequence for SOC for Cybersecurity questions:

1. Identify whether the subject is an entity-wide cyber risk management program.
2. Separate management’s responsibilities from the practitioner’s responsibilities.
3. Evaluate management’s description against description criteria.
4. Evaluate controls against suitable control criteria.
5. Distinguish design effectiveness from operating effectiveness.
6. Compare the fact pattern with SOC 1, SOC 2, and SOC 3 before selecting the report type.
7. Remember that the report provides assurance, not a breach-free guarantee.

Review Questions