SSAE 18 - Attestation Standards (SOC Reporting)
AT-C 320: Reporting on an Examination of Controls at a Service Organization – SSAE 18 - Attestation Standards (SOC Reporting)

SSAE 18 - Attestation Standards (SOC Reporting) 320.25: AT-C 320.25 Obtaining Evidence Regarding Management's Description of the Service Organization's System

What does 320.25 require?

The auditor obtains the description, reads it, and judges whether the in-scope parts are fairly presented in every material respect under the assertion's criteria: whether the control objectives are reasonable, whether the controls described were actually put in place, whether complementary user entity and subservice organisation controls are properly described, and whether the subservice organisation's services are properly described with the carve-out or inclusive method stated.

Maintained by Gerard BlokdykControl text last updated

Other controls in AT-C 320: Reporting on an Examination of Controls at a Service Organization – SSAE 18 - Attestation Standards (SOC Reporting)

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SSAE 18 - Attestation Standards (SOC Reporting) controls