Certified Lead SOC 2 Analyst flashcards
Certified Lead SOC 2 Analyst · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Trust Services Criteria
- The control framework used in SOC 2 examinations, comprising common criteria CC1-CC9 plus supplemental criteria for Availability, Processing Integrity, Confidentiality, and Privacy.
- Common Criteria
- The mandatory Security criteria in a SOC 2 examination, organized into nine categories covering control environment, communication, risk assessment, monitoring, control activities, and logical and physical access.
- SOC 2 Type 1
- A report expressing an opinion on the fairness of the system description and the suitability of control design at a specified date, without testing operating effectiveness over a period.
- SOC 2 Type 2
- A report covering both suitability of design and operating effectiveness of controls throughout a specified period, supported by tests of controls and results.
- System Description
- Management's narrative of the system covering infrastructure, software, people, procedures, data, services provided, boundaries, and relevant complementary user entity controls.
- CUECs
- Complementary user entity controls that user organizations must implement for the service organization's controls to be effective; they are described in the SOC 2 report.
- Restricted Use Report
- A SOC 2 report distributed only to management, user entities, and specified parties under confidentiality terms, unlike a general-use SOC 3 seal report.
- Management Assertion
- Management's written statement that the system description is fairly presented and that controls were suitably designed and operating effectively, which the auditor opines on.
- System Boundary
- The defined set of services, infrastructure, software, people, data, and processes included in the SOC 2 examination scope.
- Carve-Out Method
- A presentation method that excludes subservice organization controls from the description and testing, disclosing them instead as complementary subservice organization controls.
- Inclusive Method
- A presentation method that includes subservice organization controls within the system description and subjects them to the service auditor's testing.
- Gap Analysis
- A comparison of current controls and available evidence against selected trust services criteria, producing a register of gaps, owners, severity, and remediation dates.
- Scoping Memo
- A document recording the system boundary, selected criteria, locations, infrastructure, and justified exclusions, reviewed by management and the auditor.
- Risk Assessment Mapping
- The process of identifying threats to the system and mapping each threat to mitigating controls and the trust services criteria they support.
- CSOCs
- Complementary subservice organization controls that a subservice organization must perform for the service organization's controls to be effective, disclosed in carve-out reports.
- In-Scope Criteria Selection
- The determination of which trust services criteria apply, driven by contractual commitments, marketing claims, customer expectations, and the nature of the service.
- Control Owner
- The named individual accountable for performing a control at its stated frequency and retaining evidence of performance for the examination period.
- Population Completeness
- The test that a control population is complete by reconciling it to an independent source system report before sampling from it.
- Attribute Sampling
- A sampling approach used to test operating effectiveness, where sample size increases with population size and desired reliance, and deviations are evaluated for impact.
- Evidence Artifact
- A dated, attributable record such as a system report, ticket, approval, log, or reconciliation that demonstrates a control was performed as described.
- Control Exception
- A deviation from the control description or expected performance that must be evaluated for root cause, severity, and whether it is isolated or systemic.
- Segregation of Duties
- The separation of incompatible responsibilities, such as development and production deployment, so that no single person can introduce and release unauthorized changes.
- Period Coverage
- The requirement that evidence demonstrate control performance across the entire examination period, not only at a single point in time.
- Access Review Evidence
- Documented periodic reviews of user access with reviewer sign-off, confirming that access remains appropriate and timely removal occurs after termination.
- Tests of Controls Section
- The report section listing each control, the test performed, sample size, results, and exceptions, supporting the auditor's conclusion on operating effectiveness.
- Qualified Opinion
- An auditor's opinion stating that, except for a specified matter, controls were suitably designed and operating effectively; the exception is described in the report.
- Bridging Letter
- A letter addressing the period between report dates, used to communicate control status to customers; it does not replace a new SOC 2 examination.
- Trust Center
- A public or gated portal where a service organization publishes compliance information and distributes SOC 2 reports under confidentiality terms.
- Continuous Monitoring
- Ongoing tracking of control performance metrics, exception trends, remediation timelines, and periodic internal review to sustain readiness between examinations.
- Report Distribution Log
- A record of who received the SOC 2 report, when, and under what confidentiality acknowledgment, supporting restricted-use compliance.
- Management Review
- Pre-issuance review confirming the system description is accurate, CUECs are complete, and the report is consistent with actual practice.
- Adverse Opinion
- An auditor's opinion that controls were not suitably designed or operating effectively, or that the system description is materially misstated.