SOC for Cybersecurity Audit Services — DC, Maryland & Virginia

The AICPA SOC for Cybersecurity framework is a voluntary attestation engagement in which an independent CPA examines and reports on an entity's cybersecurity risk management program. It was introduced by the AICPA in 2017 and uses two sets of criteria: the Description Criteria (DC/2022) to evaluate how management describes the cybersecurity risk management program, and the Trust Services Criteria for Security to evaluate the effectiveness of controls. The resulting report can be shared with boards, investors, regulators, and other stakeholders.

SOC 2 is designed specifically for service organizations and covers controls relevant to their customers (user entities). It uses the AICPA Trust Service Criteria and produces a restricted-use report shared only with user entities and their auditors. SOC for Cybersecurity, by contrast, applies to ANY organization — not just service providers — and examines the enterprise-wide cybersecurity risk management program rather than just system-level controls. The resulting report is general-use and can be distributed publicly to boards, investors, and regulators.

Organizations that benefit most include public companies whose boards require independent cybersecurity attestation, government contractors seeking evidence-based cybersecurity programs, companies undergoing M&A due diligence, organizations seeking cyber insurance at favorable rates, and entities operating in regulated industries (healthcare, financial services, defense). Unlike SOC 2, SOC for Cybersecurity is not limited to technology or service companies — any organization with a cybersecurity risk management program can undergo the engagement.

The AICPA Cybersecurity Description Criteria (DC/2022) are the benchmarks used to evaluate how management describes its cybersecurity risk management program. The criteria cover nine areas: (1) nature of the entity's business and operations, (2) cybersecurity risk management program objectives, (3) factors affecting inherent cybersecurity risks, (4) cybersecurity risk governance structure, (5) cybersecurity risk assessment process, (6) cybersecurity communications and quality of information, (7) monitoring of the cybersecurity risk management program, (8) cybersecurity control activities, and (9) third-party management.

Timing depends on the size and complexity of your cybersecurity risk management program, how much documentation already exists and when your report is due. The examination has three phases: readiness assessment and documentation review, fieldwork and control testing, and reporting and management response. We agree on a schedule with you before fieldwork starts and plan around your deadline. Organizations that have already developed a mature cybersecurity risk management program and written policies will move through readiness more quickly.

Yes. The SOC for Cybersecurity report is a general-use report, meaning it can be shared with any intended user — including boards of directors, investors, regulators, cyber insurance underwriters, and customers. This is a key distinction from SOC 2, which is restricted-use. However, because the report contains detailed descriptions of an organization's cybersecurity program and controls, management should carefully consider what information to include in the description to avoid inadvertently disclosing exploitable details.

The NIST Cybersecurity Framework (CSF) and SOC for Cybersecurity are complementary but separate. The NIST CSF is a risk management framework organizations use to structure their cybersecurity program (Identify, Protect, Detect, Respond, Recover). SOC for Cybersecurity is an attestation engagement in which a CPA independently examines and reports on the cybersecurity risk management program. An organization can use the NIST CSF as the foundation for its cybersecurity program, then obtain a SOC for Cybersecurity examination to provide independent assurance to stakeholders.

Government contractors in Northern Virginia pursuing FedRAMP authorization or DoD contracts with CMMC requirements may benefit significantly from SOC for Cybersecurity. While CMMC and FedRAMP have their own specific requirements, a SOC for Cybersecurity examination provides independent CPA attestation of the enterprise cybersecurity risk management program — evidence that can support FedRAMP System Security Plans and demonstrate cybersecurity maturity to agency contracting officers.