Requirements & evidence
SOC for Cybersecurity
AICPA's board- and enterprise-risk-oriented cybersecurity examination, distinct from SOC 2 — a description of an entity's cybersecurity risk-management program plus an opinion on its effectiveness, rather than a controls report for a specific service.
- Edition on record
- AICPA cybersecurity risk management reporting framework
- Issuing authority
- AICPA — SOC for Cybersecurity (opens in a new tab)
- Edition published
- Not stated by the authority
- Source last checked
Understand the scope
What the framework covers.
The library records this framework for enterprise risk, financial services, critical infrastructure, across US. The issuing authority determines applicability; your assessment scope should identify the organization, systems, services, and edition being assessed.
Areas of requirement
- Description criteria
- Risk management program
- Trust services criteria (security)
- Management's assertion
The library tracks the authority and edition. A normalized requirement catalog is not available for this framework, so a requirement count is not stated here.
Source access and licensing
AICPA-controlled — the same posture as SOC 1/SOC 2; obtain the description criteria and applicable trust services criteria before verbatim ingestion.
Prepare with context
The evidence behind
the requirements.
Evidence needs to demonstrate how a requirement is met within the assessment scope. Keep the source requirement, collection context, responsible owner, review decision, and period of applicability together.
A framework-specific collection workflow has not been activated. The reference material on this page can inform scoping and preparation; it does not establish evidence collection or assessment readiness.
ControlFrame availability
Framework reference available
Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.
How availability is determined
SOC for Cybersecurity is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.
Catalog status: Planned. Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented.
Named and tracked only; criteria are entity-specific, so there is no fixed catalog to ingest.
Follow the source
Editions and transitions.
These are the editions recorded in the library, checked September 6, 2026. Confirm the applicable edition with the authority before beginning an assessment.
- AICPA cybersecurity risk management reporting frameworkCurrent edition on recordPublication date not recorded
Check the basis
Sources you can follow.
Corroborated through independent sources; direct verification with the authority was unavailable. Source verification was recorded on September 6, 2026.
- AICPA — SOC for Cybersecurity (opens in a new tab)
Issuing authority and framework publication.
Catalog provenance and record details
Framework record: soc-for-cybersecurity.
Source artifact: acquisition required.
Parsed catalog: Not ingested.
Control families as published: Description criteria · Risk management program · Trust services criteria (security) · Management's assertion.
Record last updated: September 6, 2026.
Common questions
A closer look.
What is SOC for Cybersecurity?
AICPA's board- and enterprise-risk-oriented cybersecurity examination, distinct from SOC 2 — a description of an entity's cybersecurity risk-management program plus an opinion on its effectiveness, rather than a controls report for a specific service.
Who does SOC for Cybersecurity apply to?
SOC for Cybersecurity applies to enterprise risk, financial services, critical infrastructure, US, per AICPA — SOC for Cybersecurity.
What is the current version of SOC for Cybersecurity?
The current edition is AICPA cybersecurity risk management reporting framework, issued by AICPA — SOC for Cybersecurity. Source: https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-for-cybersecurity.
What does an assessment under SOC for Cybersecurity require?
No control catalog has been ingested for SOC for Cybersecurity yet — the registry tracks it as planned (Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented), so an assessment under this framework currently requires the authority's own catalog rather than a ControlFrame-parsed one.
At a glance
SOC for Cybersecurity
AICPA cybersecurity risk management reporting framework
- Framework reference
- Authority and edition tracked
- Evidence preparation
- Framework reference available
- Source confidence
- Independent corroboration
A framework reference describes requirements. Evidence decisions belong to a scoped assessment and a named reviewer.
Make the requirements
part of the work.
Explore how ControlFrame can organize SOC for Cybersecurity requirements, evidence preparation, and review for your assessment scope.