SOC 1 (SSAE 18 / ISAE 3402)

Engagement scope and the service organisation's responsibilities – SOC 1 (SSAE 18 / ISAE 3402)

SOC 1 (SSAE 18 / ISAE 3402) A.4: SOC 1 A.4 Select the criteria and state them in the assertion

Management selects the criteria against which the description, the design and the operation are evaluated (the description criteria of AT-C 320.15 and the design and operation criteria of .16 and .17, as the illustrative assertion restates them) and states them in its assertion so that the auditor can assess their suitability and the reader knows what the opinion measures.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Engagement scope and the service organisation's responsibilities – SOC 1 (SSAE 18 / ISAE 3402)

A.1 SOC 1 A.1 Engage an independent service auditor under AT-C 320 or ISAE 3402, choose type 1 or type 2, and define the system, the services and the period or date
A.2 SOC 1 A.2 Accept responsibility for the description and the assertion, including their completeness, accuracy and method of presentation
A.3 SOC 1 A.3 Have a reasonable basis for the assertion
A.5 SOC 1 A.5 Specify the control objectives in the description and name any party that specified them
A.6 SOC 1 A.6 Identify the risks that threaten the control objectives and design, implement and document controls that achieve them
A.7 SOC 1 A.7 Provide the written assertion with the description to user entities
A.8 SOC 1 A.8 Give the service auditor all relevant information and unrestricted access to people

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All SOC 1 (SSAE 18 / ISAE 3402) controls