Your diagnostic
What the questions look like
Every question in the free CPA ISC bank carries a full worked solution. Here is one from the pool:
Question 1
Medium
How does a SOC for Cybersecurity engagement differ from a SOC 2 engagement?
Solution
A is correct.
A key distinction is that a SOC for Cybersecurity engagement evaluates an entity's enterprise-wide cybersecurity risk management program, not a specific system or service, and the resulting report is intended for general use by a broad range of stakeholders. In contrast, a SOC 2 engagement evaluates controls at a service organization related to the Trust Services Criteria for a specific system or service, and the report is restricted to user entities, their auditors, and certain specified parties. The SOC for Cybersecurity engagement also relies on management's description criteria and on control criteria that may come from any suitable framework, while SOC 2 reports against the AICPA Trust Services Criteria.
A key distinction is that a SOC for Cybersecurity engagement evaluates an entity's enterprise-wide cybersecurity risk management program, not a specific system or service, and the resulting report is intended for general use by a broad range of stakeholders. In contrast, a SOC 2 engagement evaluates controls at a service organization related to the Trust Services Criteria for a specific system or service, and the report is restricted to user entities, their auditors, and certain specified parties. The SOC for Cybersecurity engagement also relies on management's description criteria and on control criteria that may come from any suitable framework, while SOC 2 reports against the AICPA Trust Services Criteria.
