SOC 1 (SSAE 18 / ISAE 3402)

Engagement scope and the service organisation's responsibilities – SOC 1 (SSAE 18 / ISAE 3402)

SOC 1 (SSAE 18 / ISAE 3402) A.7: SOC 1 A.7 Provide the written assertion with the description to user entities

Management supplies, alongside the description, an assertion in writing, attached to it or included in it under its own heading so that it is clearly separate, and both are provided to user entities with the report; refusal to provide the assertion ends the engagement where withdrawal is possible.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Engagement scope and the service organisation's responsibilities – SOC 1 (SSAE 18 / ISAE 3402)

A.1 SOC 1 A.1 Engage an independent service auditor under AT-C 320 or ISAE 3402, choose type 1 or type 2, and define the system, the services and the period or date
A.2 SOC 1 A.2 Accept responsibility for the description and the assertion, including their completeness, accuracy and method of presentation
A.3 SOC 1 A.3 Have a reasonable basis for the assertion
A.4 SOC 1 A.4 Select the criteria and state them in the assertion
A.5 SOC 1 A.5 Specify the control objectives in the description and name any party that specified them
A.6 SOC 1 A.6 Identify the risks that threaten the control objectives and design, implement and document controls that achieve them
A.8 SOC 1 A.8 Give the service auditor all relevant information and unrestricted access to people

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All SOC 1 (SSAE 18 / ISAE 3402) controls