SSAE 18 - Attestation Standards (SOC Reporting)

United States (AICPA attestation standards; every CPA attestation engagement, including SOC 1, SOC 2 and SOC 3)

vSSAE 18 (April 2016) as amended by SSAE Nos. 19 to 23 (through June 2024); AT-C 105 and 205 on the numbering current after SSAE 23

3 domains

178 controls

SSAE 18, Attestation Standards: Clarification and Recodification (AICPA Auditing Standards Board, April 2016, effective 1 May 2017, amended by SSAE 19 to 23), codifies the attestation standards as AT-C sections: 105 concepts common to all attestation engagements, 205 assertion-based examination engagements and 320 reporting on an examination of controls at a service organization relevant to user entities' internal control over financial reporting, the standard behind SOC 1 reports and, with the SOC 2 guide, SOC 2 and SOC 3. The graph models the 178 requirement paragraphs of AT-C 105, 205 and 320 on their current numbering with the SSAE 21 and 23 renumbering recorded.

Verified

SSAE 18 - Attestation Standards (SOC Reporting) is a compliance framework from United States (AICPA attestation standards; every CPA attestation engagement, including SOC 1, SOC 2 and SOC 3) with 3 domains and 178 controls that map to 165 other frameworks. The largest domains are AT-C 205: Assertion-Based Examination Engagements – SSAE 18 - Attestation Standards (SOC Reporting) (86 controls), AT-C 105: Concepts Common to All Attestation Engagements – SSAE 18 - Attestation Standards (SOC Reporting) (55 controls), AT-C 320: Reporting on an Examination of Controls at a Service Organization – SSAE 18 - Attestation Standards (SOC Reporting) (37 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (3)

AT-C 105: Concepts Common to All Attestation Engagements – SSAE 18 - Attestation Standards (SOC Reporting)

55 controls

Controls in the AT-C 105: Concepts Common to All Attestation Engagements – SSAE 18 - Attestation Standards (SOC Reporting) domain of SSAE 18 - Attestation Standards (SOC Reporting): 55 controls
Code	Title	Description
ssae-18-attestation-standards-soc-reporting::105.14	AT-C 105.14 Conduct of an Attestation Engagement in Accordance With the Attestation Standards	For every attestation engagement the practitioner follows this section, the level-of-service section that applies (205 e...
ssae-18-attestation-standards-soc-reporting::105.15	AT-C 105.15 Conduct of an Attestation Engagement in Accordance With the Attestation Standards	A report may state that an AT-C section was complied with only where the practitioner has met this section and every oth...
ssae-18-attestation-standards-soc-reporting::105.16	AT-C 105.16 Conduct of an Attestation Engagement in Accordance With the Attestation Standards	Reports issued under other professional standards are written so that they cannot be mistaken for reports issued under t...
ssae-18-attestation-standards-soc-reporting::105.17	AT-C 105.17 Conduct of an Attestation Engagement in Accordance With the Attestation Standards	The practitioner understands the full text of every relevant AT-C section, application material included, well enough to...
ssae-18-attestation-standards-soc-reporting::105.18	AT-C 105.18 Conduct of an Attestation Engagement in Accordance With the Attestation Standards	Every requirement of a relevant AT-C section is complied with unless the whole section is irrelevant to the engagement o...
ssae-18-attestation-standards-soc-reporting::105.19	AT-C 105.19 Conduct of an Attestation Engagement in Accordance With the Attestation Standards	When the engagement is for a government body under particular government standards, guides, procedures, statutes or rule...
ssae-18-attestation-standards-soc-reporting::105.20	AT-C 105.20 Conduct of an Attestation Engagement in Accordance With the Attestation Standards	If law or regulation prescribes a report layout or wording that is unacceptable or would have the practitioner assert so...
ssae-18-attestation-standards-soc-reporting::105.21	AT-C 105.21 Conduct of an Attestation Engagement in Accordance With the Attestation Standards	The standards impose two kinds of professional requirement: unconditional ones, signalled by 'must', which apply in ever...
ssae-18-attestation-standards-soc-reporting::105.22	AT-C 105.22 Conduct of an Attestation Engagement in Accordance With the Attestation Standards	A departure from a presumptively mandatory requirement is allowed only in rare circumstances where the prescribed proced...
ssae-18-attestation-standards-soc-reporting::105.23	AT-C 105.23 Conduct of an Attestation Engagement in Accordance With the Attestation Standards	Applicable interpretive publications are considered in planning and performing the engagement.
ssae-18-attestation-standards-soc-reporting::105.24	AT-C 105.24 Conduct of an Attestation Engagement in Accordance With the Attestation Standards	Guidance in other attestation publications is applied only after a professional judgement of its relevance and appropria...
ssae-18-attestation-standards-soc-reporting::105.25	AT-C 105.25 Acceptance and Continuance	The engagement partner confirms that the firm's acceptance and continuance policies or procedures for clients and attest...
ssae-18-attestation-standards-soc-reporting::105.26	AT-C 105.26 Acceptance and Continuance	The engagement partner uses what was learned when accepting or continuing the engagement in planning it, in doing the wo...
ssae-18-attestation-standards-soc-reporting::105.27	AT-C 105.27 Acceptance and Continuance	If the engagement team learns of information that would have led the firm to decline the engagement had it been known be...
ssae-18-attestation-standards-soc-reporting::105.28	AT-C 105.28 Preconditions for an Attestation Engagement	A practitioner carrying out an attestation engagement has to be independent, except where law or regulation obliges the...
ssae-18-attestation-standards-soc-reporting::105.29	AT-C 105.29 Preconditions for an Attestation Engagement	An attestation engagement can proceed only where: a responsible party other than the practitioner is accountable for the...
ssae-18-attestation-standards-soc-reporting::105.30	AT-C 105.30 Preconditions for an Attestation Engagement	If the preconditions are missing, the practitioner raises this with the engaging party and tries to resolve it.
ssae-18-attestation-standards-soc-reporting::105.31	AT-C 105.31 Preconditions for an Attestation Engagement	The practitioner takes an engagement only after: having no reason to think the relevant ethical requirements, including...
ssae-18-attestation-standards-soc-reporting::105.32	AT-C 105.32 Preconditions for an Attestation Engagement	If a precondition turns out to be absent after acceptance, the practitioner discusses it with the appropriate parties an...
ssae-18-attestation-standards-soc-reporting::105.33	AT-C 105.33 Acceptance of a Change in the Terms of the Engagement	The practitioner agrees to change the engagement terms only where the change is reasonably justified, and does not ignor...
ssae-18-attestation-standards-soc-reporting::105.34	AT-C 105.34 Acceptance of a Change in the Terms of the Engagement	If stepping down the level of service (an examination becoming a review, say) is justified and the sections for that lev...
ssae-18-attestation-standards-soc-reporting::105.35	AT-C 105.35 Using the Work of Participating Practitioners and Referred-to Practitioners	Where a participating practitioner's work is used, the practitioner: confirms that the participating practitioner unders...
ssae-18-attestation-standards-soc-reporting::105.36	AT-C 105.36 Using the Work of Participating Practitioners and Referred-to Practitioners	If the practitioner chooses to refer in the report to a referred-to practitioner's report, the engagement partner is res...
ssae-18-attestation-standards-soc-reporting::105.37	AT-C 105.37 Quality Management: Engagement Resources	The engagement partner determines that: enough suitable resources are allocated or accessible to the team when needed; t...
ssae-18-attestation-standards-soc-reporting::105.38	AT-C 105.38 Quality Management: Engagement Resources	If the engagement partner finds the assigned resources insufficient or inappropriate, the partner takes appropriate acti...
ssae-18-attestation-standards-soc-reporting::105.39	AT-C 105.39 Quality Management: Engagement Resources	The engagement partner is responsible for making proper use of the resources allocated or accessible to the team, bearin...
ssae-18-attestation-standards-soc-reporting::105.40	AT-C 105.40 Quality Management: Leadership Responsibilities for Managing and Achieving Quality	The engagement partner is competent and capable enough, including in the subject matter itself, to be accountable for th...
ssae-18-attestation-standards-soc-reporting::105.41	AT-C 105.41 Quality Management: Leadership Responsibilities for Managing and Achieving Quality	The engagement partner is responsible for managing and achieving quality across the engagement, which includes: fosterin...
ssae-18-attestation-standards-soc-reporting::105.42	AT-C 105.42 Quality Management: Leadership Responsibilities for Managing and Achieving Quality	In fostering that environment, the engagement partner is responsible for clear, consistent and effective actions that sh...
ssae-18-attestation-standards-soc-reporting::105.43	AT-C 105.43 Quality Management: Leadership Responsibilities for Managing and Achieving Quality	For an examination or review, the engagement partner reviews the engagement documentation at suitable stages of the work...
ssae-18-attestation-standards-soc-reporting::105.44	AT-C 105.44 Quality Management: Leadership Responsibilities for Managing and Achieving Quality	On or before the report date the engagement partner determines, through review of documentation and discussion with the...
ssae-18-attestation-standards-soc-reporting::105.45	AT-C 105.45 Quality Management: Leadership Responsibilities for Managing and Achieving Quality	Before the report is dated, the engagement partner reviews the report and the subject matter information to confirm that...
ssae-18-attestation-standards-soc-reporting::105.46	AT-C 105.46 Quality Management: Leadership Responsibilities for Managing and Achieving Quality	Before they go out, the engagement partner reviews formal written communications addressed to regulators, to management...
ssae-18-attestation-standards-soc-reporting::105.47	AT-C 105.47 Quality Management: Leadership Responsibilities for Managing and Achieving Quality	Disagreements inside the team, or between the team and whoever performs the engagement quality review or others carrying...
ssae-18-attestation-standards-soc-reporting::105.48	AT-C 105.48 Quality Management: Leadership Responsibilities for Managing and Achieving Quality	The engagement partner is responsible for seeing that disagreements are dealt with and settled under the firm's policies...
ssae-18-attestation-standards-soc-reporting::105.49	AT-C 105.49 Quality Management: Compliance With Relevant Ethical Requirements	For the duration of the engagement the engagement partner watches, by observing and asking, for signs that team members...
ssae-18-attestation-standards-soc-reporting::105.50	AT-C 105.50 Quality Management: Compliance With Relevant Ethical Requirements	The engagement partner takes responsibility for making sure that the rest of the team has been made aware of the relevan...
ssae-18-attestation-standards-soc-reporting::105.51	AT-C 105.51 Quality Management: Compliance With Relevant Ethical Requirements	If there are signs of a threat to meeting the relevant ethical requirements, the engagement partner assesses it under th...
ssae-18-attestation-standards-soc-reporting::105.52	AT-C 105.52 Quality Management: Compliance With Relevant Ethical Requirements	Throughout the engagement the engagement partner watches, by observing and asking, for any team member breaching the fir...
ssae-18-attestation-standards-soc-reporting::105.53	AT-C 105.53 Quality Management: Compliance With Relevant Ethical Requirements	If matters arising from the firm's quality management system or from other sources suggest that the ethical requirements...
ssae-18-attestation-standards-soc-reporting::105.54	AT-C 105.54 Quality Management: Compliance With Relevant Ethical Requirements	Before dating the report the engagement partner takes responsibility for determining that the relevant ethical requireme...
ssae-18-attestation-standards-soc-reporting::105.55	AT-C 105.55 Quality Management: Monitoring and Remediation, and Overall Responsibility	The engagement partner takes responsibility for understanding the information the firm communicates from its monitoring...
ssae-18-attestation-standards-soc-reporting::105.56	AT-C 105.56 Quality Management: Monitoring and Remediation, and Overall Responsibility	Before the report is dated, the engagement partner confirms having taken overall responsibility for managing quality and...
ssae-18-attestation-standards-soc-reporting::105.57	AT-C 105.57 Engagement Documentation	The practitioner prepares documentation promptly and in enough detail that an experienced practitioner who had no part i...
ssae-18-attestation-standards-soc-reporting::105.58	AT-C 105.58 Engagement Documentation	The engagement file is assembled and its administrative completion finished no later than 60 days after the report relea...
ssae-18-attestation-standards-soc-reporting::105.59	AT-C 105.59 Engagement Documentation	Once the documentation completion date has passed, nothing may be removed or thrown away from the engagement file until...
ssae-18-attestation-standards-soc-reporting::105.60	AT-C 105.60 Engagement Documentation	Any amendment or addition to the documentation after the completion date records the specific reasons for it and when an...
ssae-18-attestation-standards-soc-reporting::105.61	AT-C 105.61 Engagement Documentation	Engagement documentation belongs to the practitioner, who adopts reasonable procedures to retain it long enough to meet...
ssae-18-attestation-standards-soc-reporting::105.62	AT-C 105.62 Engagement Documentation	Because the documentation often holds confidential information, reasonable procedures keep it confidential.
ssae-18-attestation-standards-soc-reporting::105.63	AT-C 105.63 Engagement Documentation	Reasonable procedures prevent unauthorised access to the engagement documentation.
ssae-18-attestation-standards-soc-reporting::105.64	AT-C 105.64 Engagement Documentation	Any departure from a presumptively mandatory requirement is documented with the justification and with how the alternati...
ssae-18-attestation-standards-soc-reporting::105.65	AT-C 105.65 Engagement Quality Review	Where the firm requires an engagement quality review, the engagement partner determines that a reviewer has been appoint...
ssae-18-attestation-standards-soc-reporting::105.66	AT-C 105.66 Professional Skepticism and Professional Judgment	The engagement is planned and performed with professional scepticism.
ssae-18-attestation-standards-soc-reporting::105.67	AT-C 105.67 Professional Skepticism and Professional Judgment	The practitioner may treat records and documents as authentic unless there is reason to think otherwise; if circumstance...
ssae-18-attestation-standards-soc-reporting::105.68	AT-C 105.68 Professional Skepticism and Professional Judgment	Professional judgement is exercised in planning and performing the engagement.

AT-C 205: Assertion-Based Examination Engagements – SSAE 18 - Attestation Standards (SOC Reporting)

86 controls

Controls in the AT-C 205: Assertion-Based Examination Engagements – SSAE 18 - Attestation Standards (SOC Reporting) domain of SSAE 18 - Attestation Standards (SOC Reporting): 86 controls
Code	Title	Description
ssae-18-attestation-standards-soc-reporting::205.05	AT-C 205.05 Conduct of an Examination Engagement	An examination based on an assertion is carried out in line with this section, section 105, and every AT-C subject-matte...
ssae-18-attestation-standards-soc-reporting::205.06	AT-C 205.06 Preconditions for an Examination Engagement	A practitioner who lacks independence but must take the engagement because law or regulation says so disclaims an opinio...
ssae-18-attestation-standards-soc-reporting::205.07	AT-C 205.07 Agreeing on the Terms of the Engagement	The practitioner agrees the engagement terms with the engaging party and records them in enough detail in writing, for e...
ssae-18-attestation-standards-soc-reporting::205.08	AT-C 205.08 Agreeing on the Terms of the Engagement	The terms agreed cover: the objective and the scope; what the practitioner is responsible for; a statement that the work...
ssae-18-attestation-standards-soc-reporting::205.09	AT-C 205.09 Agreeing on the Terms of the Engagement	Each recurring engagement is a separate engagement; the practitioner assesses whether the earlier terms need revising an...
ssae-18-attestation-standards-soc-reporting::205.10	AT-C 205.10 Requesting a Written Assertion	The practitioner asks the responsible party for a written assertion on how the subject matter measures up against the cr...
ssae-18-attestation-standards-soc-reporting::205.11	AT-C 205.11 Planning and Performing the Engagement	The practitioner sets an overall strategy for the engagement that fixes its scope, timing and direction and steers how t...
ssae-18-attestation-standards-soc-reporting::205.12	AT-C 205.12 Planning and Performing the Engagement	When setting the strategy, the practitioner identifies the features that determine the scope, establishes the reporting...
ssae-18-attestation-standards-soc-reporting::205.13	AT-C 205.13 Planning and Performing the Engagement	The engagement plan sets out what risk assessment procedures and further procedures are planned, of what kind, when and...
ssae-18-attestation-standards-soc-reporting::205.14	AT-C 205.14 Risk Assessment Procedures	The practitioner learns enough about the subject matter and the circumstances of the engagement to identify and assess w...
ssae-18-attestation-standards-soc-reporting::205.15	AT-C 205.15 Risk Assessment Procedures	This understanding extends to internal control over how the subject matter is prepared: the practitioner evaluates how t...
ssae-18-attestation-standards-soc-reporting::205.16	AT-C 205.16 Risk Assessment Procedures	The practitioner asks the responsible party whether it has an internal audit function, and if so inquires further into t...
ssae-18-attestation-standards-soc-reporting::205.17	AT-C 205.17 Materiality in Planning and Performing the Engagement	The practitioner takes materiality into account when setting the overall strategy, when deciding what procedures to perf...
ssae-18-attestation-standards-soc-reporting::205.18	AT-C 205.18 Materiality in Planning and Performing the Engagement	Materiality is reconsidered if information comes to light during the engagement that would have led to a different initi...
ssae-18-attestation-standards-soc-reporting::205.19	AT-C 205.19 Identifying Risks of Material Misstatement	The practitioner pinpoints and evaluates where material misstatement could occur and bases further procedures on them, c...
ssae-18-attestation-standards-soc-reporting::205.20	AT-C 205.20 Responding to Assessed Risks and Obtaining Evidence	The practitioner gathers sufficient appropriate evidence to bring attestation risk down to an acceptable level and to su...
ssae-18-attestation-standards-soc-reporting::205.21	AT-C 205.21 Responding to Assessed Risks and Obtaining Evidence	The practitioner designs and puts in place overall responses addressing the misstatement risks it has assessed for the a...
ssae-18-attestation-standards-soc-reporting::205.22	AT-C 205.22 Further Procedures	Further procedures are designed and performed whose nature, timing and extent rest on and respond to the assessed risks.
ssae-18-attestation-standards-soc-reporting::205.23	AT-C 205.23 Further Procedures	In designing further procedures the practitioner weighs the reasons for each risk assessment, including the likelihood o...
ssae-18-attestation-standards-soc-reporting::205.24	AT-C 205.24 Further Procedures	The relevance and reliability of information used as evidence is considered; inconsistent evidence from different source...
ssae-18-attestation-standards-soc-reporting::205.25	AT-C 205.25 Further Procedures	Tests of controls are designed and performed to obtain sufficient appropriate evidence of operating effectiveness where...
ssae-18-attestation-standards-soc-reporting::205.26	AT-C 205.26 Further Procedures	Where tests of controls intended for reliance reveal deviations, the practitioner inquires and performs other procedures...
ssae-18-attestation-standards-soc-reporting::205.27	AT-C 205.27 Further Procedures	Regardless of the risks assessed, the practitioner designs and carries out detailed tests or analytical procedures on th...
ssae-18-attestation-standards-soc-reporting::205.28	AT-C 205.28 Further Procedures	When using analytical procedures to respond to assessed risks, the practitioner decides whether they are suitable given...
ssae-18-attestation-standards-soc-reporting::205.29	AT-C 205.29 Further Procedures	Fluctuations or relationships inconsistent with other information or significantly different from expectations are inves...
ssae-18-attestation-standards-soc-reporting::205.30	AT-C 205.30 Further Procedures	For estimates, the practitioner evaluates whether the responsible party applied the criteria's requirements appropriatel...
ssae-18-attestation-standards-soc-reporting::205.31	AT-C 205.31 Further Procedures	The practitioner responds to an assessed risk in an estimate through one or more of these: looking at events up to the r...
ssae-18-attestation-standards-soc-reporting::205.32	AT-C 205.32 Further Procedures	When sampling, the practitioner designs the sample to fit what the procedure is for and how the population is made up: t...
ssae-18-attestation-standards-soc-reporting::205.33	AT-C 205.33 Fraud, Laws, and Regulations	The practitioner considers whether risk assessment and other procedures point to a risk that fraud or breaches of law or...
ssae-18-attestation-standards-soc-reporting::205.34	AT-C 205.34 Fraud, Laws, and Regulations	The practitioner responds appropriately to any fraud, suspected fraud, breach or suspected breach of law or regulation t...
ssae-18-attestation-standards-soc-reporting::205.35	AT-C 205.35 Revision of Risk Assessment	Where further procedures or new information contradict the evidence on which the risk assessment rested, the assessment...
ssae-18-attestation-standards-soc-reporting::205.36	AT-C 205.36 Evaluating the Reliability of Information Produced by the Entity	The practitioner relies on information the entity produces only after judging whether it is reliable enough for the purp...
ssae-18-attestation-standards-soc-reporting::205.37	AT-C 205.37 Using the Work of a Practitioner's Specialist	Before using a practitioner's specialist, the practitioner: assesses whether the specialist is competent, capable and ob...
ssae-18-attestation-standards-soc-reporting::205.38	AT-C 205.38 Using the Work of a Practitioner's Specialist	Where the specialist's work proves inadequate, further work is agreed with the specialist or additional procedures are p...
ssae-18-attestation-standards-soc-reporting::205.39	AT-C 205.39 Using the Work of a Practitioner's Specialist	How much work the practitioner does on a specialist's output, of what kind and when, depends on how significant that out...
ssae-18-attestation-standards-soc-reporting::205.40	AT-C 205.40 Using the Work of Internal Auditors	Before relying on work done by the internal audit function, or on internal auditors for direct assistance, the practitio...
ssae-18-attestation-standards-soc-reporting::205.41	AT-C 205.41 Using the Work of Internal Auditors	Sufficient procedures are performed on the body of internal audit work to be used, including reperformance of some of it...
ssae-18-attestation-standards-soc-reporting::205.42	AT-C 205.42 Using the Work of Internal Auditors	Before internal auditors provide direct assistance, the responsible party confirms in writing that they will follow inst...
ssae-18-attestation-standards-soc-reporting::205.43	AT-C 205.43 Using the Work of Internal Auditors	Internal auditors giving direct assistance are directed, supervised and reviewed by the practitioner.
ssae-18-attestation-standards-soc-reporting::205.44	AT-C 205.44 Using the Work of Internal Auditors	Because the practitioner alone is responsible for the opinion, the practitioner makes every significant judgement, inclu...
ssae-18-attestation-standards-soc-reporting::205.45	AT-C 205.45 Using the Work of Internal Auditors	Before the engagement ends the practitioner evaluates whether the use of internal audit's work or direct assistance has...
ssae-18-attestation-standards-soc-reporting::205.46	AT-C 205.46 Evaluating the Results of Procedures	Misstatements identified during the engagement are accumulated, other than those clearly trivial.
ssae-18-attestation-standards-soc-reporting::205.47	AT-C 205.47 Evaluating the Results of Procedures	The practitioner judges whether the evidence is sufficient and appropriate given the engagement's circumstances, seeks m...
ssae-18-attestation-standards-soc-reporting::205.48	AT-C 205.48 Evaluating the Results of Procedures	If sufficient appropriate evidence cannot be gathered, the scope is limited, and the practitioner applies the requiremen...
ssae-18-attestation-standards-soc-reporting::205.49	AT-C 205.49 Considering Subsequent Events and Subsequently Discovered Facts	The practitioner asks the responsible party, and also the engaging party where it is a different party, about events bet...
ssae-18-attestation-standards-soc-reporting::205.50	AT-C 205.50 Considering Subsequent Events and Subsequently Discovered Facts	There is no duty to perform procedures after the report date, but facts that become known afterwards which might have le...
ssae-18-attestation-standards-soc-reporting::205.51	AT-C 205.51 Written Representations	The practitioner asks the responsible party for written representations, in a letter addressed to the practitioner, cove...
ssae-18-attestation-standards-soc-reporting::205.52	AT-C 205.52 Written Representations	If the responsible party did not engage the practitioner and will not give written representations, the practitioner que...
ssae-18-attestation-standards-soc-reporting::205.53	AT-C 205.53 Written Representations	Where the engaging party differs from the responsible party, the practitioner also asks the engaging party for written r...
ssae-18-attestation-standards-soc-reporting::205.54	AT-C 205.54 Written Representations	The practitioner checks that representations bearing directly on material matters are reasonable and fit with other evid...
ssae-18-attestation-standards-soc-reporting::205.55	AT-C 205.55 Written Representations	The written representations are dated as of the report date and address the subject matter and periods the opinion cover...
ssae-18-attestation-standards-soc-reporting::205.56	AT-C 205.56 Requested Written Representations Not Provided or Not Reliable	If the responsible party engaged the practitioner itself and a requested representation is withheld, or the representati...
ssae-18-attestation-standards-soc-reporting::205.57	AT-C 205.57 Requested Written Representations Not Provided or Not Reliable	Where the responsible party did not engage the practitioner and gives acceptable oral answers in place of a written repr...
ssae-18-attestation-standards-soc-reporting::205.58	AT-C 205.58 Other Information	If the report will appear in a document that holds other information, the practitioner reads that information looking fo...
ssae-18-attestation-standards-soc-reporting::205.59	AT-C 205.59 Description of Criteria	The practitioner judges whether the written account of the subject matter or assertion properly describes the criteria o...
ssae-18-attestation-standards-soc-reporting::205.60	AT-C 205.60 Forming the Opinion	The practitioner forms the opinion, on whether, in every material respect, the subject matter conforms to the criteria o...
ssae-18-attestation-standards-soc-reporting::205.61	AT-C 205.61 Forming the Opinion	Drawing on the evidence gathered, the practitioner judges whether the way the subject matter or assertion is presented w...
ssae-18-attestation-standards-soc-reporting::205.62	AT-C 205.62 Preparing the Practitioner's Report	The practitioner's report is in writing.
ssae-18-attestation-standards-soc-reporting::205.63	AT-C 205.63 Preparing the Practitioner's Report	The report contains: a title that uses the word independent; a suitable addressee; what subject matter or assertion is c...
ssae-18-attestation-standards-soc-reporting::205.64	AT-C 205.64 Preparing the Practitioner's Report	The practitioner adds an alert limiting who may use the report where the criteria fit only a small number of parties who...
ssae-18-attestation-standards-soc-reporting::205.65	AT-C 205.65 Preparing the Practitioner's Report	The alert says that the report is meant only for the use and information of the named specified parties, lists them, and...
ssae-18-attestation-standards-soc-reporting::205.66	AT-C 205.66 Preparing the Practitioner's Report	If the engagement is also carried out under Government Auditing Standards, the restricting alert instead explains what t...
ssae-18-attestation-standards-soc-reporting::205.67	AT-C 205.67 Preparing the Practitioner's Report	The practitioner reports on the subject matter itself or on the written assertion; where a material misstatement leads t...
ssae-18-attestation-standards-soc-reporting::205.68	AT-C 205.68 Preparing the Practitioner's Report	When reporting on the assertion, the assertion is bound with or accompanies the report or is clearly stated in it.
ssae-18-attestation-standards-soc-reporting::205.69	AT-C 205.69 Reference to the Practitioner's Specialist	A report giving an unmodified opinion makes no mention of work done by a practitioner's specialist.
ssae-18-attestation-standards-soc-reporting::205.70	AT-C 205.70 Modified Opinions	The opinion is modified where the practitioner cannot obtain sufficient appropriate evidence or concludes that the subje...
ssae-18-attestation-standards-soc-reporting::205.71	AT-C 205.71 Modified Opinions	A modified opinion is accompanied by a separate paragraph describing the matters that gave rise to it.
ssae-18-attestation-standards-soc-reporting::205.72	AT-C 205.72 Modified Opinions	A qualified opinion is expressed where misstatements are material but not pervasive, or where evidence could not be obta...
ssae-18-attestation-standards-soc-reporting::205.73	AT-C 205.73 Modified Opinions	A qualification for material misstatement says that, apart from the effects of the matters described, the subject matter...
ssae-18-attestation-standards-soc-reporting::205.74	AT-C 205.74 Modified Opinions	An adverse opinion is expressed where misstatements are both material and pervasive.
ssae-18-attestation-standards-soc-reporting::205.75	AT-C 205.75 Modified Opinions	An adverse opinion says that, given how significant the matters are, the subject matter does not conform in all material...
ssae-18-attestation-standards-soc-reporting::205.76	AT-C 205.76 Modified Opinions	Where the conditions found amount to one or more material misstatements measured against the criteria, the opinion is mo...
ssae-18-attestation-standards-soc-reporting::205.77	AT-C 205.77 Modified Opinions	An opinion is disclaimed where sufficient appropriate evidence cannot be obtained and the possible effects of undetected...
ssae-18-attestation-standards-soc-reporting::205.78	AT-C 205.78 Modified Opinions	A disclaimer for lack of evidence says that, given how significant the matters are, the practitioner was unable to gathe...
ssae-18-attestation-standards-soc-reporting::205.79	AT-C 205.79 Modified Opinions	Where the opinion is qualified or adverse, the report's account of what the practitioner is responsible for says that su...
ssae-18-attestation-standards-soc-reporting::205.80	AT-C 205.80 Modified Opinions	Where the practitioner disclaims because evidence is lacking, the report states that the practitioner's engagement was t...
ssae-18-attestation-standards-soc-reporting::205.81	AT-C 205.81 Modified Opinions	Where the opinion is modified for a scope limitation and the practitioner also knows of a material misstatement, the rep...
ssae-18-attestation-standards-soc-reporting::205.82	AT-C 205.82 Modified Opinions	The opinion is clearly separated from any paragraph emphasising matters or covering other reporting responsibilities, an...
ssae-18-attestation-standards-soc-reporting::205.83	AT-C 205.83 Modified Opinions	When the opinion is modified, the report may mention an external specialist if doing so helps to explain the modificatio...
ssae-18-attestation-standards-soc-reporting::205.84	AT-C 205.84 Responsible Party Refuses to Provide a Written Assertion	If the responsible party engaged the practitioner itself and will not give a written assertion, the practitioner withdra...
ssae-18-attestation-standards-soc-reporting::205.85	AT-C 205.85 Responsible Party Refuses to Provide a Written Assertion	Where the law does not allow withdrawal in that case, the opinion is disclaimed.
ssae-18-attestation-standards-soc-reporting::205.86	AT-C 205.86 Responsible Party Refuses to Provide a Written Assertion	If two separate parties hold the engaging and responsible roles and the responsible party will not supply a written asse...
ssae-18-attestation-standards-soc-reporting::205.87	AT-C 205.87 Communication Responsibilities	The practitioner informs the responsible party (and also, if it is a separate party, whoever engaged the practitioner) a...
ssae-18-attestation-standards-soc-reporting::205.88	AT-C 205.88 Communication Responsibilities	Before reporting known or suspected fraud or noncompliance to the responsible party or to whoever engaged the practition...
ssae-18-attestation-standards-soc-reporting::205.89	AT-C 205.89 Documentation	The documentation is detailed enough to show what procedures were performed under the AT-C sections and applicable law,...
ssae-18-attestation-standards-soc-reporting::205.90	AT-C 205.90 Documentation	If further or new procedures are carried out, or fresh conclusions reached, after the report is dated, the documentation...

AT-C 320: Reporting on an Examination of Controls at a Service Organization – SSAE 18 - Attestation Standards (SOC Reporting)

37 controls

Controls in the AT-C 320: Reporting on an Examination of Controls at a Service Organization – SSAE 18 - Attestation Standards (SOC Reporting) domain of SSAE 18 - Attestation Standards (SOC Reporting): 37 controls
Code	Title	Description
ssae-18-attestation-standards-soc-reporting::320.09	AT-C 320.09 Management and Those Charged With Governance	Wherever this section has the service auditor inquire of, request representations from or communicate with the service o...
ssae-18-attestation-standards-soc-reporting::320.10	AT-C 320.10 Preconditions	The auditor takes on or keeps the engagement only where the section 105 preconditions hold, the scope and description ar...
ssae-18-attestation-standards-soc-reporting::320.11	AT-C 320.11 Preconditions	Where the inclusive method is used, sections 105 and 205 and this section also apply to the services of the subservice o...
ssae-18-attestation-standards-soc-reporting::320.12	AT-C 320.12 Preconditions	A request by management to change the scope before completion is refused where no reasonable justification exists, as se...
ssae-18-attestation-standards-soc-reporting::320.13	AT-C 320.13 Requesting a Written Assertion	A written assertion is requested from the service organisation's management; if management refuses, the auditor withdraw...
ssae-18-attestation-standards-soc-reporting::320.14	AT-C 320.14 Assessing the Suitability of the Criteria	The auditor judges whether the criteria management relied on were suitable for drafting the description, for evaluating...
ssae-18-attestation-standards-soc-reporting::320.15	AT-C 320.15 Assessing the Suitability of the Criteria	For a fair description, the criteria require as a minimum that it shows how the system has been designed and put in plac...
ssae-18-attestation-standards-soc-reporting::320.16	AT-C 320.16 Assessing the Suitability of the Criteria	For control design to be suitable, the criteria require as a minimum that management has identified the risks to the con...
ssae-18-attestation-standards-soc-reporting::320.17	AT-C 320.17 Assessing the Suitability of the Criteria	For controls to be judged effective in operation, the criteria require as a minimum that they were applied consistently,...
ssae-18-attestation-standards-soc-reporting::320.18	AT-C 320.18 Assessing the Suitability of the Criteria	Management's assertion must cover each criterion management applied when judging whether the description is fair, whethe...
ssae-18-attestation-standards-soc-reporting::320.19	AT-C 320.19 Materiality	The auditor weighs materiality when judging whether the description is fair, whether the controls are designed well enou...
ssae-18-attestation-standards-soc-reporting::320.20	AT-C 320.20 Obtaining an Understanding of the Service Organization's System and Assessing the Risk of Material Misstatement	The auditor learns how the system and the in-scope controls work, including how the service organisation drafts the desc...
ssae-18-attestation-standards-soc-reporting::320.21	AT-C 320.21 Obtaining an Understanding of the Service Organization's System and Assessing the Risk of Material Misstatement	If the service organisation has internal auditors, the auditor's understanding extends to what that function is responsi...
ssae-18-attestation-standards-soc-reporting::320.22	AT-C 320.22 Obtaining an Understanding of the Service Organization's System and Assessing the Risk of Material Misstatement	The risks of material misstatement are identified, as section 205 requires.
ssae-18-attestation-standards-soc-reporting::320.23	AT-C 320.23 Obtaining an Understanding of the Service Organization's System and Assessing the Risk of Material Misstatement	The auditor reads any internal audit and regulatory examination reports touching the services and the scope, to understa...
ssae-18-attestation-standards-soc-reporting::320.24	AT-C 320.24 Responding to Assessed Risks and Further Procedures	Overall responses to the assessed risks are designed and implemented and further procedures designed and performed whose...
ssae-18-attestation-standards-soc-reporting::320.25	AT-C 320.25 Obtaining Evidence Regarding Management's Description of the Service Organization's System	The auditor obtains the description, reads it, and judges whether the in-scope parts are fairly presented in every mater...
ssae-18-attestation-standards-soc-reporting::320.26	AT-C 320.26 Obtaining Evidence Regarding Management's Description of the Service Organization's System	Through inquiries combined with other procedures the auditor determines whether the system has been implemented.
ssae-18-attestation-standards-soc-reporting::320.27	AT-C 320.27 Obtaining Evidence Regarding the Design of Controls	The auditor judges whether the controls management identifies as meeting the control objectives are suitably designed by...
ssae-18-attestation-standards-soc-reporting::320.28	AT-C 320.28 Obtaining Evidence Regarding the Operating Effectiveness of Controls	For a type 2 engagement, the auditor tests the controls management identifies and judges whether they worked effectively...
ssae-18-attestation-standards-soc-reporting::320.29	AT-C 320.29 Obtaining Evidence Regarding the Operating Effectiveness of Controls	In a type 2 engagement the auditor understands the system changes made during the period; changes user entities and thei...
ssae-18-attestation-standards-soc-reporting::320.30	AT-C 320.30 Obtaining Evidence Regarding the Operating Effectiveness of Controls	The auditor relies on information the service organisation generates only after judging whether it is reliable, by getti...
ssae-18-attestation-standards-soc-reporting::320.31	AT-C 320.31 Obtaining Evidence Regarding the Operating Effectiveness of Controls	Tests of controls combine inquiry with inspection, observation or reperformance to learn how, how consistently and by wh...
ssae-18-attestation-standards-soc-reporting::320.32	AT-C 320.32 Obtaining Evidence Regarding the Operating Effectiveness of Controls	For each deviation found, the auditor looks into what it was and why it happened, then decides whether: the deviations f...
ssae-18-attestation-standards-soc-reporting::320.33	AT-C 320.33 Obtaining Evidence Regarding the Operating Effectiveness of Controls	If deviations stem from fraud committed by service organisation staff, the auditor assesses the risk that the descriptio...
ssae-18-attestation-standards-soc-reporting::320.34	AT-C 320.34 Obtaining Evidence Regarding the Operating Effectiveness of Controls	When the auditor learns of fraud, breaches of law or regulation, or uncorrected misstatements caused by management or st...
ssae-18-attestation-standards-soc-reporting::320.35	AT-C 320.35 Subsequent Events	If an event after the period needs to be disclosed so that readers are not misled, whether the report is type 1 or type...
ssae-18-attestation-standards-soc-reporting::320.36	AT-C 320.36 Written Representations	In addition to the representations section 205 requires, management confirms in writing that it has told the auditor abo...
ssae-18-attestation-standards-soc-reporting::320.37	AT-C 320.37 Written Representations	Under the inclusive method the same written representations are also obtained from the subservice organisation's managem...
ssae-18-attestation-standards-soc-reporting::320.38	AT-C 320.38 Written Representations	For both type 1 and type 2 engagements, the auditor asks the service organisation's management for the written represent...
ssae-18-attestation-standards-soc-reporting::320.39	AT-C 320.39 Other Information	Where the report is to appear in a document with other information, the section 205 requirements on reading that informa...
ssae-18-attestation-standards-soc-reporting::320.40	AT-C 320.40 Content of the Service Auditor's Report	A type 2 report includes a title with the word independent, an addressee, identification of the description, the functio...
ssae-18-attestation-standards-soc-reporting::320.41	AT-C 320.41 Content of the Service Auditor's Report	A type 1 report includes the same elements as a type 2 report except that it identifies a specified date rather than a p...
ssae-18-attestation-standards-soc-reporting::320.42	AT-C 320.42 Modified Opinions	The auditor modifies the opinion, explaining every reason plainly, when judged by the criteria management's assertion se...
ssae-18-attestation-standards-soc-reporting::320.43	AT-C 320.43 Modified Opinions	If the auditor intends to disclaim because evidence is lacking, yet the limited work done has revealed that parts of the...
ssae-18-attestation-standards-soc-reporting::320.44	AT-C 320.44 Modified Opinions	When the auditor disclaims an opinion, the report leaves out any account of the procedures carried out and any descripti...
ssae-18-attestation-standards-soc-reporting::320.45	AT-C 320.45 Other Communication Responsibilities	Where the auditor learns of the noncompliance, fraud or uncorrected misstatements that may affect user entities, the aud...

Your Compliance Coverage

If you comply with SSAE 18 - Attestation Standards (SOC Reporting), you already cover:

SOC for Cybersecurity - Cybersecurity Risk Management Examination

14 controls mapped

Compare →

SOC 2

13 controls mapped

Compare →

South Korea ISMS-P

13 controls mapped

Compare →

+ 162 more: NIST Cybersecurity Framework 2.0 (5%), NIST SP 800-53 Rev 5 (5%)

See all 165 mapped frameworks ↓

Maps to 165 other frameworks

245 total controls

SOC for Cybersecurity - Cybersecurity Risk Management Examination

14 source controls mapped|10 target controls covered

SOC 2

13 source controls mapped|13 target controls covered

South Korea ISMS-P

13 source controls mapped|10 target controls covered

NIST Cybersecurity Framework 2.0

13 source controls mapped|18 target controls covered

NIST SP 800-53 Rev 5

13 source controls mapped|22 target controls covered

TISAX - Trusted Information Security Assessment Exchange

12 source controls mapped|7 target controls covered

Singapore Government Instruction Manual on ICT&SS Management (IM8)

12 source controls mapped|8 target controls covered

NIST SP 800-190

12 source controls mapped|8 target controls covered

Security of Critical Infrastructure Act 2018 (SOCI)

10 source controls mapped|10 target controls covered

ISO/IEC 27019:2024

10 source controls mapped|7 target controls covered

IEC 62443

10 source controls mapped|7 target controls covered

API 1164

10 source controls mapped|7 target controls covered

NIST SP 1800-32

10 source controls mapped|7 target controls covered

BSI IT-Grundschutz

9 source controls mapped|10 target controls covered

Annex 11 to EU GMP - Computerised Systems

9 source controls mapped|5 target controls covered

ASIS SPC.1-2009 - Organizational Resilience Standard

9 source controls mapped|6 target controls covered

ISO/IEC 27031:2011

9 source controls mapped|6 target controls covered

UK GDPR (UK General Data Protection Regulation)

8 source controls mapped|3 target controls covered

FTC GLBA Safeguards Rule (16 CFR Part 314)

8 source controls mapped|4 target controls covered

ISO/IEC 27557:2022 - Organisational Privacy Risk Management

8 source controls mapped|8 target controls covered

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)

8 source controls mapped|11 target controls covered

Barbados Data Protection Act 2019

8 source controls mapped|5 target controls covered

AICPA Privacy Management Framework (PMF)

8 source controls mapped|7 target controls covered

ISO/IEC 23894:2023

8 source controls mapped|10 target controls covered

ISO/IEC 27400:2022

8 source controls mapped|6 target controls covered

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)

8 source controls mapped|6 target controls covered

ISO/IEC 27011:2024

8 source controls mapped|7 target controls covered

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition)

8 source controls mapped|5 target controls covered

UK Security and Emergency Measures Direction (SEMD) - Water Industry

8 source controls mapped|5 target controls covered

SANS Incident Handler's Handbook and PICERL Methodology

8 source controls mapped|7 target controls covered

Virginia CDPA

7 source controls mapped|2 target controls covered

Uruguay DPL

7 source controls mapped|3 target controls covered

UK AI Regulation Framework

7 source controls mapped|3 target controls covered

Texas Data Privacy and Security Act (TDPSA)

7 source controls mapped|2 target controls covered

Taiwan PDPA

7 source controls mapped|2 target controls covered

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)

7 source controls mapped|3 target controls covered

Saudi Arabia PDPL

7 source controls mapped|6 target controls covered

ISO/IEC 29134:2023

7 source controls mapped|4 target controls covered

UK Open Banking Standard

7 source controls mapped|8 target controls covered

SASB Standards

7 source controls mapped|9 target controls covered

Bahrain PDPL

7 source controls mapped|6 target controls covered

ISO/IEC 27043:2015

7 source controls mapped|5 target controls covered

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity

7 source controls mapped|4 target controls covered

ISO/SAE 21434

7 source controls mapped|5 target controls covered

ASD Strategies to Mitigate Cyber Security Incidents

7 source controls mapped|8 target controls covered

NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management

7 source controls mapped|4 target controls covered

ISO 26262:2018 - Functional Safety for Road Vehicles

7 source controls mapped|3 target controls covered

FFIEC IT Examination Handbook

7 source controls mapped|10 target controls covered

PCI P2PE

7 source controls mapped|10 target controls covered

PCI SSF

7 source controls mapped|10 target controls covered

PCI PIN Security

7 source controls mapped|11 target controls covered

FFIEC Cybersecurity Assessment Tool (CAT)

6 source controls mapped|6 target controls covered

Authorised Economic Operator (AEO) Programmes - Global Standards

6 source controls mapped|3 target controls covered

Kuwait National Cybersecurity Framework

6 source controls mapped|2 target controls covered

APRA CPS 230 Operational Risk Management

6 source controls mapped|5 target controls covered

ISO/IEC 27003:2017

6 source controls mapped|3 target controls covered

EASA Part-IS - Information Security in Aviation

6 source controls mapped|8 target controls covered

ISO 22320:2018

6 source controls mapped|7 target controls covered

Trinidad and Tobago Data Protection Act 2011

5 source controls mapped|5 target controls covered

Tanzania Personal Data Protection Act 2022

5 source controls mapped|4 target controls covered

Florida Digital Bill of Rights (FDBR)

5 source controls mapped|4 target controls covered

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018)

5 source controls mapped|6 target controls covered

COSO Internal Control - Integrated Framework (2013)

5 source controls mapped|4 target controls covered

GDPR

5 source controls mapped|6 target controls covered

UK Age Appropriate Design Code (Children's Code)

5 source controls mapped|5 target controls covered

ISO 27799:2025

5 source controls mapped|3 target controls covered

IEC 62351 - Power Systems Communication Security

5 source controls mapped|4 target controls covered

US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements

5 source controls mapped|3 target controls covered

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence

5 source controls mapped|5 target controls covered

AML/CTF Act 2006 (Australia)

5 source controls mapped|3 target controls covered

UK Telecommunications (Security) Act 2021

5 source controls mapped|3 target controls covered

UK FCA/PRA Operational Resilience Framework

5 source controls mapped|3 target controls covered

FedRAMP High

5 source controls mapped|2 target controls covered

FedRAMP Moderate

5 source controls mapped|2 target controls covered

ISO/IEC 29147:2018

5 source controls mapped|5 target controls covered

FBI CJIS Security Policy

5 source controls mapped|3 target controls covered

Singapore Cybersecurity Act 2018

5 source controls mapped|3 target controls covered

IEC 62304:2015 Medical Device Software Lifecycle Processes

5 source controls mapped|8 target controls covered

ISO 28001:2007 Supply Chain Security Management

5 source controls mapped|4 target controls covered

ITIL 4

5 source controls mapped|3 target controls covered

ISO/IEC 20000-1:2018

5 source controls mapped|3 target controls covered

FedRAMP Rev 5

5 source controls mapped|2 target controls covered

ITU-T X.805 - Security Architecture for End-to-End Communications

4 source controls mapped|3 target controls covered

Connecticut Data Privacy Act (CTDPA)

4 source controls mapped|1 target controls covered

ISO/IEC 29100:2024

4 source controls mapped|6 target controls covered

APPI

4 source controls mapped|5 target controls covered

Azerbaijan Law on Personal Data (2010)

4 source controls mapped|4 target controls covered

Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)

4 source controls mapped|2 target controls covered

WHO Global Strategy on Digital Health 2020-2025

4 source controls mapped|2 target controls covered

Albania Law No. 124/2024 on Personal Data Protection

4 source controls mapped|3 target controls covered

Sweden Data Protection Act (Dataskyddslag, 2018:218)

4 source controls mapped|3 target controls covered

Uganda Data Protection and Privacy Act (2019)

4 source controls mapped|3 target controls covered

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0

4 source controls mapped|5 target controls covered

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices

4 source controls mapped|5 target controls covered

ISO 19650 - Organisation and Digitisation of Information about Buildings and Civil Engineering Works (BIM)

4 source controls mapped|4 target controls covered

US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties

4 source controls mapped|2 target controls covered

ICAO Annex 17 - Aviation Security (AVSEC)

4 source controls mapped|2 target controls covered

APRA SPS 220 Risk Management (Superannuation)

4 source controls mapped|2 target controls covered

UAE Virtual Asset Regulatory Authority (VARA) Regulations

4 source controls mapped|3 target controls covered

Responsible Minerals Initiative (RMI) - Responsible Minerals Assurance Process

4 source controls mapped|4 target controls covered

APRA CPS 234

4 source controls mapped|6 target controls covered

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers

4 source controls mapped|3 target controls covered

Armenia Law on Protection of Personal Data (2015)

3 source controls mapped|4 target controls covered

WCAG 2.2

3 source controls mapped|1 target controls covered

ISO/IEC 29115:2013 - Entity Authentication Assurance Framework

3 source controls mapped|4 target controls covered

ISO/IEC 23837:2023

3 source controls mapped|2 target controls covered

Illinois Biometric Information Privacy Act (BIPA)

3 source controls mapped|2 target controls covered

UNESCO Recommendation on the Ethics of AI

3 source controls mapped|2 target controls covered

ISO 22000:2018

3 source controls mapped|1 target controls covered

ISO 22313:2020 - Guidance on Business Continuity Management Systems

3 source controls mapped|1 target controls covered

SQF Code Edition 9 - Safe Quality Food

3 source controls mapped|2 target controls covered

UK Modern Slavery Act 2015

3 source controls mapped|1 target controls covered

IAIS Insurance Core Principles (ICPs)

3 source controls mapped|3 target controls covered

IEC 60601-1 - Medical Electrical Equipment Safety

3 source controls mapped|4 target controls covered

ISO 20400:2017 - Sustainable Procurement

3 source controls mapped|3 target controls covered

Telecommunications Sector Security Reforms (TSSR)

3 source controls mapped|2 target controls covered

ISO/TS 22318:2021

3 source controls mapped|2 target controls covered

ISO/TS 22317:2021

3 source controls mapped|2 target controls covered

ISO 22316

3 source controls mapped|2 target controls covered

ISO/IEC 27010:2015

3 source controls mapped|2 target controls covered

Science Based Targets Initiative (SBTi) - Net-Zero Standard

3 source controls mapped|2 target controls covered

ISO/IEC 30111:2019

3 source controls mapped|5 target controls covered

COBIT 2019

3 source controls mapped|2 target controls covered

ISO/IEC 27007:2020

3 source controls mapped|2 target controls covered

ISO/IEC 25012:2008 - Data Quality Model

3 source controls mapped|3 target controls covered

Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019)

2 source controls mapped|1 target controls covered

Australian Privacy Principles (APPs)

2 source controls mapped|3 target controls covered

Azure Security Benchmark

2 source controls mapped|1 target controls covered

UK Data Protection Act 2018

2 source controls mapped|3 target controls covered

Samoa Telecommunications Act 2005

2 source controls mapped|2 target controls covered

US Automated Commercial Environment (ACE) - CBP Trade Data Requirements

2 source controls mapped|1 target controls covered

3GPP 5G Security Architecture (TS 33.501)

2 source controls mapped|3 target controls covered

BS 65000:2014 - Guidance on Organizational Resilience

2 source controls mapped|3 target controls covered

Solvency II

2 source controls mapped|5 target controls covered

ISO 30401

2 source controls mapped|1 target controls covered

ISO 9001:2015

2 source controls mapped|1 target controls covered

Nevada Gaming Control Board Cybersecurity Requirements

2 source controls mapped|1 target controls covered

Canada ITSG-33 - IT Security Risk Management

2 source controls mapped|1 target controls covered

NATO STANAG 4774 (Confidentiality Metadata Labels) and STANAG 4778 (Metadata Binding)

2 source controls mapped|2 target controls covered

ISO/IEC 27004:2016

2 source controls mapped|3 target controls covered

ISO 41001:2018 - Facility Management Systems

2 source controls mapped|2 target controls covered

Nebraska Data Privacy Act

2 source controls mapped|2 target controls covered

Automotive SPICE (ASPICE) v4.1 - Process Assessment Model

2 source controls mapped|2 target controls covered

ISO 14064 - Greenhouse Gas Accounting and Verification (Parts 1-3)

2 source controls mapped|1 target controls covered

ISO/IEC 17025:2017 - General Requirements for Testing and Calibration

2 source controls mapped|2 target controls covered

ISO 56002

2 source controls mapped|2 target controls covered

ISO/IEC 27050-1:2019

2 source controls mapped|1 target controls covered

PCI DSS 4.0

2 source controls mapped|1 target controls covered

DFARS 252.204-7012 - Safeguarding Covered Defense Information

2 source controls mapped|1 target controls covered

ISO/IEC 27014:2020

2 source controls mapped|2 target controls covered

ISO 8000 - Data Quality

2 source controls mapped|2 target controls covered

US Foreign Corrupt Practices Act (FCPA)

2 source controls mapped|1 target controls covered

UK Bribery Act 2010

2 source controls mapped|2 target controls covered

US SEC Digital Assets and Crypto Regulatory Framework

2 source controls mapped|2 target controls covered

Bank Secrecy Act / Anti-Money Laundering (BSA/AML)

1 source controls mapped|1 target controls covered

W3C Verifiable Credentials (VC) Data Model 2.0

1 source controls mapped|1 target controls covered

Singapore AI Governance Framework

1 source controls mapped|1 target controls covered

Aged Care Quality Standards 2019 (repealed edition)

1 source controls mapped|1 target controls covered

AS9100D - Aerospace Quality Management System

1 source controls mapped|1 target controls covered

ISO 27002:2022

1 source controls mapped|1 target controls covered

Space ISAC (Information Sharing and Analysis Center) - Threat Framework

1 source controls mapped|1 target controls covered

21 CFR Part 58 - Good Laboratory Practice (GLP)

1 source controls mapped|1 target controls covered

ISO 22301:2019

1 source controls mapped|2 target controls covered

US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements

1 source controls mapped|1 target controls covered

Secure by Design: A Guide for Manufacturers (CISA)

1 source controls mapped|1 target controls covered

Compare SSAE 18 - Attestation Standards (SOC Reporting) with SOC for Cybersecurity - Cybersecurity Risk Management Examination

Coverage is not the same as your position

This page shows what SSAE 18 - Attestation Standards (SOC Reporting) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is SSAE 18 - Attestation Standards (SOC Reporting) and who does it apply to?

SSAE 18 - Attestation Standards (SOC Reporting) is a compliance framework from United States (AICPA attestation standards; every CPA attestation engagement, including SOC 1, SOC 2 and SOC 3) with 3 domains and 178 controls. SSAE 18, Attestation Standards: Clarification and Recodification (AICPA Auditing Standards Board, April 2016, effective 1 May 2017, amended by SSAE 19 to 23), codifies the attestation standards as AT-C sections: 105 concepts common to all attestation engagements, 205 assertion-based examination engagements and 320 reporting on an examination of controls at a service organization relevant to user entities' internal control over financial reporting, the standard behind SOC 1 reports and, with the SOC 2 guide, SOC 2 and SOC 3. The graph models the 178 requirement paragraphs of AT-C 105, 205 and 320 on their current numbering with the SSAE 21 and 23 renumbering recorded. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does SSAE 18 - Attestation Standards (SOC Reporting) actually require?

SSAE 18 - Attestation Standards (SOC Reporting) has 178 controls organised across 3 domains. The largest domains are AT-C 205: Assertion-Based Examination Engagements – SSAE 18 - Attestation Standards (SOC Reporting) (86 controls), AT-C 105: Concepts Common to All Attestation Engagements – SSAE 18 - Attestation Standards (SOC Reporting) (55 controls), AT-C 320: Reporting on an Examination of Controls at a Service Organization – SSAE 18 - Attestation Standards (SOC Reporting) (37 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of SSAE 18 - Attestation Standards (SOC Reporting) do I already cover?

SSAE 18 - Attestation Standards (SOC Reporting) maps to 165 other compliance frameworks. The top mapping partners are SOC for Cybersecurity - Cybersecurity Risk Management Examination (6% coverage), SOC 2 (5% coverage), South Korea ISMS-P (5% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement SSAE 18 - Attestation Standards (SOC Reporting)?

Start your SSAE 18 - Attestation Standards (SOC Reporting) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about SSAE 18 - Attestation Standards (SOC Reporting) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 178 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,121 frameworks.

Get Started Free →

Free forever, no credit card required