AICPA SOC 3
Management responsibilities and assertion – AICPA SOC 3

AICPA SOC 3 M-5: Identify subservice organisations and choose the inclusive or carve-out method

Management identifies subservice organisations used in delivering the system, decides for each whether to present it by the carve-out approach or the inclusive approach, and under carve-out identifies the complementary subservice organisation controls (CSOCs) assumed to operate there (Guide 2.191, 2.193).

Maintained by Gerard BlokdykControl text last updated

Other controls in Management responsibilities and assertion – AICPA SOC 3

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll AICPA SOC 3 controls