Restricted Use Audit Report

C.

SOC Type 1 reports are considered "restricted use" reports.

They are intended for management and stakeholders of an organization, clients of the service organization, and auditors of the organization.

They are not intended for release beyond those audiences.

The correct answer is SOC Type 2.

SOC (Service Organization Control) audits are independent evaluations of the controls implemented by a service organization to ensure that it complies with industry best practices and standards, and to give assurance to its customers that their data is being protected. SOC audits are conducted by third-party auditors and provide a comprehensive report that details the effectiveness of the service organization's controls.

SOC Type 1 and SOC Type 2 reports are two types of audit reports that service organizations can obtain. SOC Type 1 reports assess the design of the controls at a specific point in time, while SOC Type 2 reports assess the operating effectiveness of the controls over a period of time.

A SOC Type 2 report is intended for a restricted audience, meaning it is only provided to the service organization and its customers. This is because a SOC Type 2 report contains sensitive information about the effectiveness of the controls that the service organization has implemented, and this information should not be made public. Therefore, SOC Type 2 reports are considered restricted use reports.

In contrast, SAS-70 and SSAE-16 reports are older versions of SOC reports that are no longer used. SAS-70 reports were replaced by SSAE-16 reports, which were then replaced by SOC reports. Neither SAS-70 nor SSAE-16 reports are considered restricted use reports for their intended audience.