Get audit-ready for SOC 1
SOC 1 (SSAE 18) · Service Organization Control 1
Report on controls at a service organization relevant to user entities' internal control over financial reporting, following SSAE 18 attestation standards.
SOC 1What is SOC 1?
Report on controls at a service organization relevant to user entities' internal control over financial reporting, following SSAE 18 attestation standards.
Who it applies to
Service organisations whose processing affects their customers financial statements — payroll, claims and transaction processors. Requested by the customers auditors, not by their security team.
How the standard is organised
Reports on controls relevant to internal control over financial reporting, which is what separates it from SOC 2: same reporting machinery, different subject matter entirely.
Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Readiness Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.
SOC 1 on the Bitkosh platform
The 35 SOC 1 controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- SOC1-MON-04Point-in-time versus period readiness
Track readiness for a design-only (Type 1) or design-and-operating-effectiveness (Type 2) examination, including evidence retention across the period.
Monitoring and Reporting Readiness - SOC1-GOV-02Ethics and conduct expectations
Set and communicate integrity and conduct expectations for personnel handling customer financial data, and track acknowledgement.
Governance and Risk - SOC1-GOV-06Subservice organisation oversight
Review the assurance, contracts and performance of subservice organisations, and document how their controls are monitored.
Governance and Risk - SOC1-CUE-03CUEC currency review
Review the list of user entity responsibilities when the service or controls change, and update communications accordingly.
Complementary User Entity Controls - SOC1-TXN-07Reconciliations
Reconcile processed totals with source records and external parties at defined intervals, with independent review of reconciling items.
Transaction Processing - SOC1-TXN-03Input accuracy and validation
Validate transaction data on entry for format, range and mandatory fields so inaccurate input is rejected or flagged.
Transaction Processing
More information security & cybersecurity frameworks
Frequently Asked Questions
Who publishes SOC 1, and who does it apply to?
How is SOC 1 conformance demonstrated?
How is SOC 1 structured?
Ready to get audit-ready for SOC 1?
See how the Bitkosh Readiness Platform gets you audit-ready for SOC 1 — and the other 47 ready frameworks — from a single control library.