Information Security & Cybersecurity

Automate SOC 1 report readiness

SOC 1 (SSAE 18) · Service Organization Control 1

Report on controls at a service organization relevant to user entities' internal control over financial reporting, following SSAE 18 attestation standards.

35 controls24/7 continuous monitoring

Book a Demo All frameworks

SOC 1

Overview

What is SOC 1?

Report on controls at a service organization relevant to user entities' internal control over financial reporting, following SSAE 18 attestation standards.

Who it applies to

Service organisations whose processing affects their customers financial statements — payroll, claims and transaction processors. Requested by the customers auditors, not by their security team.

How the standard is organised

Reports on controls relevant to internal control over financial reporting, which is what separates it from SOC 2: same reporting machinery, different subject matter entirely.

Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Compliance Management Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.

On the platform

SOC 1 on the Bitkosh platform

The 35 SOC 1 controls sit in one workspace, evidence is collected from the systems you already run, and shared controls satisfy the equivalent requirement in the other 34 frameworks at the same time — so a second framework costs a fraction of the first.

How the platform works

Frequently Asked Questions

Who publishes SOC 1, and who does it apply to?

SOC 1 is published by AICPA - the American Institute of Certified Public Accountants. Service organisations whose processing affects their customers financial statements — payroll, claims and transaction processors. Requested by the customers auditors, not by their security team.

How is SOC 1 conformance demonstrated?

Attested in a report issued by an independent CPA firm. The report is produced by an independent CPA firm rather than a certification body, which is why SOC 1 produces a report to share rather than a certificate to display.

How is SOC 1 structured?

Reports on controls relevant to internal control over financial reporting, which is what separates it from SOC 2: same reporting machinery, different subject matter entirely. Bitkosh tracks 35 SOC 1 controls against it, each with its own evidence requirements, owner and review cadence.

Let's build together

Ready to automate SOC 1?

See how the Bitkosh Compliance Management Platform gets you audit-ready for SOC 1 and 34 other frameworks from a single control library.

Book a Demo Send an enquiry