Your glossary for risk and compliance
Helpful definitions of all of the terms you need to know to better manage risk and compliance.
Trusted by the world’s leading organisations
TermsAFSL Authorised Representative AICPA Annex A Controls ASIC Attestation of Compliance (AOC) Business Continuity Management Compliance Automation Software Compliance Risk Management Cybersecurity Maturity Model Certification (CMMC) FedRAMP Governance Risk & Compliance (GRC) GPDR HIPAA HITRUST Incident Management Information Security Management System (ISMS) ISMS Governing Body ISO 27001 Notifiable Data Breach OAIC Policy Management SOC 1 SOC 2 SOC 3 SOC Reports SOC Trust Services Criteria (TSC) SSAE 16 SSAE 18 Third Party Risk Management Vendor Assessment Vendor Management Policy Vendor Review Vulnerability Vulnerability Management
What are SOC Reports?
A service organization controls (SOC) report is a way to verify that an organization is following specific best practices related to protecting their clients' data before you outsource a business function to that organization.
These best practices are related to finances, security, processing integrity, privacy, and availability. The reports, which are created and validated by third-party auditors, are built to provide independent assurance and to help potential customers and/or partners understand any potential risks involved in working with the organization that was evaluated.
You may decide to pursue a SOC report because you're working to sign on a client who values security, or your own company works with sensitive data and you want to be proactive in setting up security controls.
Depending on the information needed and the types of organizations involved, there are several versions of SOC reports.
SOC 1, SOC 2, and SOC 3
You may also hear "SOC" referring to a security operations center. That's a separate definition and meaning that doesn't impact your compliance obligations.