SOC 1 report (controls relevant to user entities' financial reporting)
A CPA's report on a service provider's controls that matter to its customers' financial statements; relevant for data centre operators whose uptime or physical security feeds a customer's financial reporting.
- 5requirementsin our own words
- 0editions none dated yet
- 0places where it is a duty of 30 assessed
- 18 Oct 2026last checkedat the sources below
Where it applies
It is voluntary in the 30 places assessed. The outcome holds under the conditions shown and says nothing about any one site.
| Where | Outcome | Basis | Conditions | Authority and route |
|---|---|---|---|---|
| All 30 places | Applies | Voluntary In force | Sector: customers whose financial reporting depends on the service No law in this country requires it; customers, lenders or tenders decide. | Not stated |
What it asks for
5 requirements, each in our own words with the evidence an assessor would expect and who on a site usually owns it. Read the clause itself on the scheme owner's page.
| Requirement | Evidence expected | Owner | When |
|---|---|---|---|
| Define the service, system boundary and control objectives that matter to customers' financial reporting. | System description and control objective list Policy, checked by document review | Compliance manager | Every year Governance, a system or service |
| Design and operate the controls that meet the stated objectives (for a data centre: physical access, environment, change, backup). | Control matrix and operating evidence Record, checked by document review | Quality | Continuous Governance, a system or service |
| Monitor controls and gather evidence during the report period so a Type 2 examination can test operation. | Control test log by month Log, checked by document review | Quality | Continuous Governance, a system or service |
| Describe and monitor subservice organisations (for example a landlord or power provider) and their controls. | Subservice list and their reports Contract, checked by document review | Procurement | Every year Governance, a system or service |
| Engage a CPA firm, agree the period and keep the report current for customers. | Engagement letter and report distribution list Contract, checked by document review | Compliance manager | Every year Contractual, the organisation |
Stages, levels and report types
What each one is, how long it is valid, and the claim you may make once you hold it.
| Stage or level | Report or award | Period and validity | What you may say |
|---|---|---|---|
| Type 1 | assurance report (SOC 1) | as of one datereport covers a date; no certificate | Say: SOC 1 Type 1 report as of DATE issued by CPA firm. A SOC report is an auditor's report, not a certificate; do not write 'SOC 1 certified'. |
| Type 2 | assurance report (SOC 1) | a period set by the engagement (length not fixed on the AICPA pages read)report covers a period; no certificate | Say: SOC 1 Type 2 report for the period FROM-TO; never 'SOC 1 certified'. |
About the programme
- Scheme owner
- AICPA & CIMA
- Assessed by
- An independent auditor
- Scope
- service or system of a service organisation
- Levels
- Type 1 (design at a date) and Type 2 (operation over a period)
- Validity
- A report covers a date or period; there is no certificate expiry. Customers usually ask for a fresh report each year (practice, not stated by AICPA on the page read).
- Accreditation route
- none: licensed CPA firms; AICPA page refers to peer review enrolment
- Who asks for it
- Financial-sector clients, Enterprise and colocation customers, Wholesale and hyperscale customers
- Where it is used
- global (US-origin; ISAE 3402 is the international counterpart)
Sources
Official bodies behind this page, each with the date we last read it.
No official body publishes a page for this scheme. The scheme owner's own page, linked under About the programme, is where the clauses are published.
Not legal advice. Confirm each duty against the text itself.