The RSI security site breaks down the ways in some element, but the process in essence goes such as this: The distinction between the differing types of SOC audits lies during the scope and period of your assessment: It’s especially crucial that each approved user have their own entry ID, https://www.nathanlabsadvisory.com/blog/tag/regulatory-requirements/