SOC 1 (SSAE 18 / ISAE 3402)

The description of the system (the description criteria) – SOC 1 (SSAE 18 / ISAE 3402)

SOC 1 (SSAE 18 / ISAE 3402) B.12: SOC 1 B.12 Omit and distort nothing relevant, while writing for the common needs of a broad range of user entities

Nothing relevant to the system is left out of the description or misrepresented in it, and the description may address the needs that user entities and their auditors, across a wide range, share rather than every aspect each user entity might consider important; the auditor evaluates fair presentation against these criteria, materiality included.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in The description of the system (the description criteria) – SOC 1 (SSAE 18 / ISAE 3402)

B.1 SOC 1 B.1 Describe the types of services provided and the classes of transactions processed
B.10 SOC 1 B.10 Describe the other relevant aspects of the control environment, risk assessment, information and communication, control activities and monitoring
B.11 SOC 1 B.11 In a type 2 report, describe the relevant changes to the system during the period
B.2 SOC 1 B.2 Describe the procedures by which transactions are initiated, authorised, recorded, processed, corrected and reported
B.3 SOC 1 B.3 Describe the information and records used in performing the procedures
B.4 SOC 1 B.4 Describe how the system captures and addresses significant events and conditions other than transactions
B.5 SOC 1 B.5 Describe the process used to prepare reports and other information for user entities
B.6 SOC 1 B.6 Describe the subservice organisations used and whether the carve-out or the inclusive method applies

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All SOC 1 (SSAE 18 / ISAE 3402) controls