System and Organization Controls (SOC) 1 Type 2

  • Articolo

SOC 1 Type 2 overview

System and Organization Controls (SOC) for Service Organizations are internal control reports created by the American Institute of Certified Public Accountants (AICPA). They're intended to examine services provided by a service organization so that end users can assess and address the risk associated with an outsourced service.

A SOC 1 Type 2 attestation is performed under:

  • SSAE No. 18, Attestation Standards: Clarification and Recodification, which includes AT-C section 320, Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting (AICPA, Professional Standards).
  • SOC 1 Reporting on an Examination of Controls at a Service Organization Relevant to User Entities’ Internal Control Over Financial Reporting (AICPA Guide).

The SOC 1 attestation has replaced SAS 70, and it is appropriate for reporting on controls at a service organization relevant to user entities internal controls over financial reporting. A Type 2 report includes auditor’s opinion on the control effectiveness to achieve the related control objectives during the specified monitoring period.

Azure and SOC 1 Type 2

Microsoft Azure, Dynamics 365, and other Microsoft cloud services undergo regular independent third-party audits for SOC 1 Type 2 compliance. For more information, see the Azure SOC 1 Type 2 attestation report. Aside from the AICPA Statement on Standards for Attestation Engagements 18 (SSAE 18), the Azure SOC 1 Type 2 audit is conducted in accordance with the International Standard on Assurance Engagements No. 3402 (ISAE 3402).

Applicability

  • Azure
  • Azure Government

Services in scope

For a list of Microsoft cloud services in audit scope, see the Azure SOC 1 Type 2 attestation report or Cloud services in audit scope:

  • Azure
  • Dynamics 365
  • Microsoft 365
  • Power Platform

For Azure DevOps, see the standalone Azure DevOps SOC 1 Type 2 attestation report.

Office 365 and SOC 1 Type 2

For more information about Office 365 compliance, see Office 365 SOC 1 documentation.

Audit reports

The Azure SOC 1 Type 2 attestation report covers Azure, Dynamics 365, Power Platform, and select Microsoft 365 cloud services. You can access Azure SOC audit reports and bridge letters from the Service Trust Portal (STP) SOC reports section. For instructions on how to access audit reports, see Audit documentation.

The Azure DevOps SOC 1 Type 2 attestation report is available separately from the Service Trust Portal SOC reports section.

Frequently asked questions

How often are Azure SOC 1 reports issued?
SOC reports for Azure, Dynamics 365, and other online services are based on a rolling 12-month run window (audit period) with new reports issued quarterly. It takes approximately six weeks to produce and publish the attestation report following the end of the audit period. Bridge letters are issued during the first week of each quarter to cover the prior three-month period. For example, the January letter covers 1-Oct through 31-Dec, the April letter covers 1-Jan through 31-Mar, the July letter covers 1-Apr through 30-Jun, and the October letter covers 1-Jul through 30-Sep.

Where can I get the Azure SOC audit documentation including bridge letters?
For links to audit documentation, see Audit reports.

If you're an Azure DevOps customers who can't access the Service Trust Portal, you can email Azure DevOps for its SOC 1 and SOC 2 reports. This email is to request Azure DevOps SOC reports only.

How can my organization benefit from Azure SOC 1 Type 2 attestation?
You can rely on the Azure SOC 1 Type 2 attestation when pursuing your own financial industry specific compliance requirements such as Sarbanes-Oxley (SOX), Federal Financial Institutions Examination Council (FFIEC), Gramm-Leach-Bliley Act (GLBA), and others.

Where can I see management responses to exceptions noted?
Management responses are located towards the end of the SOC attestation report. Search the document for "Management Response".

Where can I see user entity responsibilities?
User entity responsibilities are located at the very end of the SOC attestation report. Search the document for "User Entity Responsibilities".

Resources