Certified Cloud Security Professional (CCSP) Practice Exam

What does Service Organization Controls 1 (SOC 1) report on?

1. Internal Control over financial reporting at service organizations

2. Controls at a Service Organization Relevant to Security and Privacy

3. Privacy aspects of cloud computing

4. Electronic healthcare transactions

The correct answer is: Internal Control over financial reporting at service organizations

The correct answer is A. The Service Organization Controls 1 (SOC 1) report focuses on the internal control over financial reporting at service organizations. It is specifically designed for service organizations that provide services that could impact their clients' internal control over financial reporting. SOC 1 reports are important for organizations that outsource processes that are likely to impact the financial statements of their clients, such as payroll processing or data center operations. Choices B, C, and D are incorrect as they do not accurately represent the focus of a SOC 1 report. Choice B refers to SOC 2 reports, which are specifically related to security, availability, processing integrity, confidentiality, and privacy at a service organization. Choice C focuses on privacy aspects, which are generally covered in a SOC 2 report rather than a SOC 1 report. Choice D, electronic healthcare transactions, is not directly related to the scope of a SOC 1 report, as it mainly deals with financial reporting controls.