SOC Regulatory Compliance & Legal Framework 2

Question 1

Under the Gramm-Leach-Bliley Act (GLBA), which SOC report type is most commonly required for financial institutions demonstrating safeguards compliance?

Accepted Answer

SOC 2 Type II

Answer

SOC 2 Type II is the most commonly referenced report for financial institutions needing to demonstrate compliance with GLBA Safeguards Rule controls over a period of time.

Question 2

Which federal regulation primarily governs the protection of Protected Health Information (PHI) and directly influences SOC 2 engagements for healthcare service organizations?

Accepted Answer

HIPAA

Answer

HIPAA establishes requirements for safeguarding PHI and directly shapes the privacy and security criteria evaluated in SOC 2 engagements for healthcare-related service organizations.

Question 3

A service organization's SOC 1 report is based on which professional standard issued by the AICPA?

Accepted Answer

AT-C Section 315

Answer

SOC 1 engagements are performed under AT-C Section 315, which addresses examination engagements on controls at a service organization relevant to user entities' internal control over financial reporting.

Question 4

Which of the following best describes a 'carve-out' method in a SOC report?

Accepted Answer

Removing a subservice organization from the scope of the service auditor's procedures

Answer

The carve-out method excludes a subservice organization from the scope of the service auditor's procedures, leaving responsibility for those controls with the user entity.

Question 5

The Children's Online Privacy Protection Act (COPPA) most directly impacts which SOC 2 Trust Service Criterion?

Accepted Answer

Privacy

Answer

COPPA governs the collection and use of personal information from children under 13, directly affecting the Privacy criterion in SOC 2 engagements for applicable service organizations.

(SOC) System and Organization Controls Certification Practice Test

(SOC) System and Organization Controls Certification Practice Test

SOC Regulatory Compliance & Legal Framework 2