SOC 1 (SSAE 18 / ISAE 3402) D.6: SOC 1 D.6 Restricted use: the report is intended solely for user entities, their auditors and the service organisation's management

The report carries an alert restricting its use to three groups: the service organisation's own management; entities that used the system in the period; and the auditors of those entities' financial statements or internal control, provided they understand enough to weigh the report alongside other information; the service organisation distributes it accordingly, usually under nondisclosure, and does not use it as marketing or a certification.