SSAE 18 - Attestation Standards (SOC Reporting)
What is SSAE 18 - Attestation Standards (SOC Reporting)?
Statement on Standards for Attestation Engagements No. 18 (SSAE 18) provides the framework for SOC (System and Organization Controls) reporting engagements. It comprises 178 controls organised across 3 domains, published by AICPA, and applies in International.
How SSAE 18 - Attestation Standards (SOC Reporting) maps to other frameworks
All 178 controls, each one mapped to the equivalent requirement in other standards, with the evidence that carries across and the mappings that were judged and rejected shown alongside. No account needed to look.
See the control mappings →The 3 domains SSAE 18 - Attestation Standards (SOC Reporting) groups its controls into
Frameworks that share controls with SSAE 18 - Attestation Standards (SOC Reporting)
Each of these has at least one control mapped to a control in SSAE 18 - Attestation Standards (SOC Reporting). The number is how many SSAE 18 - Attestation Standards (SOC Reporting) controls are shared, counted from the mapping graph.
TISAX - Trusted Information Security Assessment Exchange
12 shared controlsUK GDPR (UK General Data Protection Regulation)
8 shared controlsFTC GLBA Safeguards Rule (16 CFR Part 314)
8 shared controlsVirginia CDPA
7 shared controlsUruguay DPL
7 shared controlsUK AI Regulation Framework
7 shared controlsTexas Data Privacy Act
7 shared controlsTaiwan PDPA
7 shared controlsWhere SSAE 18 - Attestation Standards (SOC Reporting) overlaps with the standards you already hold
Where to get trained on SSAE 18 - Attestation Standards (SOC Reporting)
One course in the catalogue covers SSAE 18 - Attestation Standards (SOC Reporting) directly. Each is self-paced, includes the downloadable toolkit and the implementation playbook, and carries a certificate of completion.
Training more than one person? Ten seats of any course is $1,490 on a single licence, against $199 a seat bought one at a time.
What an auditor will ask you for
All 67 SSAE 18 - Attestation Standards (SOC Reporting) controls, each with what it requires, the artefacts an auditor will ask you for, and where it commonly fails. Free to read, nothing to fill in.
Read the SSAE 18 - Attestation Standards (SOC Reporting) evidence request listWhat SSAE 18 - Attestation Standards (SOC Reporting) means in your sector
What SSAE 18 - Attestation Standards (SOC Reporting) means for your job
Questions people ask about SSAE 18 - Attestation Standards (SOC Reporting)
What is SSAE 18 - Attestation Standards?
How many controls does SSAE 18 - Attestation Standards have?
Where does SSAE 18 - Attestation Standards apply?
What frameworks does SSAE 18 - Attestation Standards map to?
How do I get started with SSAE 18 - Attestation Standards compliance?
Query SSAE 18 - Attestation Standards (SOC Reporting) programmatically
SSAE 18 - Attestation Standards (SOC Reporting), its 178 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.
SSAE 18 - Attestation Standards (SOC Reporting) API reference and MCP config →What SSAE 18 - Attestation Standards (SOC Reporting) requires, control by control
Each page carries the requirement text for one SSAE 18 - Attestation Standards (SOC Reporting) control and what an assessor expects to see as evidence.
- A1-1 A1.1 - Availability Commitments and Requirements
- A1-2 A1.2 - Environmental Protections and Recovery
- A1-3 A1.3 - Recovery Plan Testing
- CC3-1 CC3.1 - COSO Principle 6: Risk Identification
- CC3-2 CC3.2 - COSO Principle 7: Risk Analysis
- CC3-4 CC3.4 - COSO Principle 9: Change Management
- CC6-2 CC6.2 - New User Registration and Authorization
- CC6-4 CC6.4 - Physical Access Restrictions
- CC7-4 CC7.4 - Incident Response
- CC7-5 CC7.5 - Incident Recovery
How ready are you for SSAE 18 - Attestation Standards (SOC Reporting)?
Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.