OtherUnited States (AICPA)
SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR)
What is SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR)?
SOC 1 reports, issued under SSAE 18 (AT-C Section 320) by the AICPA, provide assurance on controls at a service organisation relevant to user entities' internal control over financial reporting (ICFR). The US equivalent of ISAE 3402. It comprises 27 controls organised across 5 domains, published by AICPA, and applies in the United States (AICPA).
Map this against the frameworks you already hold
The compliance knowledge graph holds cross-framework control mappings for hundreds of standards, including the ones you are likely to be certified against already.
Browse the framework graph →The 5 domains SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) groups its controls into
Complementary Controls and Reporting
Reporting and Monitoring
Transaction Processing Controls
IT General Controls
Control Environment
Where SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) overlaps with the standards you already hold
SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) vs ISO 27001:2022View comparison →SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) vs SOC 2View comparison →SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) vs NIST CSF 2.0View comparison →SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) vs GDPRView comparison →SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) vs HIPAAView comparison →SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) vs PCI DSS 4.0View comparison →
What SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) means in your sector
SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) for Healthcare→SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) for Financial Services→SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) for Technology→SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) for Government→SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) for Manufacturing→SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) for Energy→SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) for Retail→SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) for Education→
What SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) means for your job
SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) for CISOs→SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) for Compliance Officers→SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) for Risk Managers→SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) for IT Directors→SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) for DPOs→SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) for Auditors→
Questions people ask about SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR)
What is SSAE 18 SOC 1?
SOC 1 reports, issued under SSAE 18 (AT-C Section 320) by the AICPA, provide assurance on controls at a service organisation relevant to user entities' internal control over financial reporting (ICFR). The US equivalent of ISAE 3402.
How many controls does SSAE 18 SOC 1 have?
SSAE 18 SOC 1 contains 27 controls organized across 5 domains.
Where does SSAE 18 SOC 1 apply?
SSAE 18 SOC 1 is applicable in United States (AICPA). Organizations operating in or serving customers in this jurisdiction should evaluate its requirements.
How do I get started with SSAE 18 SOC 1 compliance?
Start by understanding the framework's key controls and domains. Our compliance platform provides AI-powered gap analysis and mapping tools to help you assess your current posture and build a remediation plan.
Query SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) programmatically
SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR), its 27 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.
SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR) API reference and MCP config →How ready are you for SSAE 18 SOC 1 — Report on Controls at a Service Organisation (ICFR)?
Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.
Written and maintained by Gerard Blokdyk, The Art of Service.Last updated .