SSAE 18: every control, and what you already have

308 controls 184 frameworks share controls with it United States (AICPA attestation standards; every CPA attestation engagement, including SOC 1, SOC 2 and SOC 3) verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

SSAE 18 SOC Reporting Evidence & Implementation Kit

308 controls is the documentation set somebody has to write. This is that set, already written: an adopt-ready artifact for every control in policy and procedure text you edit rather than draft, and the evidence checklist an auditor asks for against each.

See what is in it, $249

The same set every buyer of this kit receives. Nothing here is produced on request.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
SOC for Cybersecurity	14	measure it →
NIST Cybersecurity Framework 2.0	13	measure it →
SOC 2	13	measure it →
NIST SP 800-53 Rev 5	13	measure it →
South Korea ISMS-P	13	measure it →
Singapore Government Instruction Manual on ICT&SS Management (IM8)	12	measure it →
ISO 27017	12	measure it →
ISO 27018	12	measure it →
NIST SP 800-190	12	measure it →
TISAX	12	measure it →
Security of Critical Infrastructure Act 2018 (SOCI)	10	measure it →
API 1164	10	measure it →

Every control

Code	Control	Also in
`SSAE-01`	Common Attestation Concepts (AT-C 105)	0
`SSAE-02`	Examination Engagements (AT-C 205)	0
`SSAE-03`	Review Engagements (AT-C 210)	0
`SSAE-04`	Agreed-Upon Procedures (AT-C 215)	0
`SSAE-05`	SOC 1 Engagements (AT-C 320)	0
`SSAE-06`	SOC 2 Engagements (AT-C 205 with TSC)	0
`SSAE-07`	SOC 3 General Use Reports	0
`SSAE-08`	Preconditions for Attestation Engagement	0
`SSAE-09`	Independence and Ethics	1
`SSAE-10`	Engagement Risk Assessment	0
`SSAE-11`	Materiality in Attestation	0
`SSAE-12`	Written Representations	0
`SSAE-13`	Other Information in Reports	0
`SSAE-14`	Reporting on Pro Forma Financial Information (AT-C 310)	0
`SSAE-15`	Reporting on Compliance (AT-C 315)	0
`SSAE-16`	Examinations of Prospective Financial Information (AT-C 305)	0
`SSAE-17`	Engagement Documentation	0
`SSAE-18`	Quality Management at Firm and Engagement Level	0
`SSAE-19`	Modifications to the Standard Report	0
`SSAE-20`	Use by Specified Parties and Restricted Distribution	0
`SSAE18-A1.1`	A1.1 - Availability Commitments and Requirements	30
`SSAE18-A1.2`	A1.2 - Environmental Protections and Recovery	36
`SSAE18-A1.3`	A1.3 - Recovery Plan Testing	36
`SSAE18-C1.1`	C1.1 - Confidential Information Identification	0
`SSAE18-C1.2`	C1.2 - Confidential Information Disposal	0
`SSAE18-CC1.1`	CC1.1 - COSO Principle 1: Integrity and Ethical Values	0
`SSAE18-CC1.2`	CC1.2 - COSO Principle 2: Board Independence and Oversight	0
`SSAE18-CC1.3`	CC1.3 - COSO Principle 3: Management Structure and Authority	0
`SSAE18-CC1.4`	CC1.4 - COSO Principle 4: Commitment to Competence	0
`SSAE18-CC1.5`	CC1.5 - COSO Principle 5: Accountability	0
`SSAE18-CC2.1`	CC2.1 - COSO Principle 13: Quality Information	0
`SSAE18-CC2.2`	CC2.2 - COSO Principle 14: Internal Communication	0
`SSAE18-CC2.3`	CC2.3 - COSO Principle 15: External Communication	0
`SSAE18-CC3.1`	CC3.1 - COSO Principle 6: Risk Identification	69
`SSAE18-CC3.2`	CC3.2 - COSO Principle 7: Risk Analysis	69
`SSAE18-CC3.3`	CC3.3 - COSO Principle 8: Fraud Risk Assessment	0
`SSAE18-CC3.4`	CC3.4 - COSO Principle 9: Change Management	25
`SSAE18-CC5.1`	CC5.1 - COSO Principle 10: Control Activity Selection	0
`SSAE18-CC5.2`	CC5.2 - COSO Principle 11: Technology General Controls	0
`SSAE18-CC5.3`	CC5.3 - COSO Principle 12: Control Activity Policies	0
`SSAE18-CC6.1`	CC6.1 - Logical Access Security Software	0
`SSAE18-CC6.2`	CC6.2 - New User Registration and Authorization	50
`SSAE18-CC6.3`	CC6.3 - Access Removal	0
`SSAE18-CC6.4`	CC6.4 - Physical Access Restrictions	16
`SSAE18-CC6.5`	CC6.5 - Logical Access to Protected Assets	0
`SSAE18-CC6.6`	CC6.6 - External Threats and Security Measures	0
`SSAE18-CC6.7`	CC6.7 - Data Transmission Restrictions	0
`SSAE18-CC6.8`	CC6.8 - Unauthorized Software Prevention	0
`SSAE18-CC7.1`	CC7.1 - Infrastructure and Software Monitoring	0
`SSAE18-CC7.2`	CC7.2 - Anomaly Monitoring in Operations	0
`SSAE18-CC7.3`	CC7.3 - Security Event Evaluation	0
`SSAE18-CC7.4`	CC7.4 - Incident Response	132
`SSAE18-CC7.5`	CC7.5 - Incident Recovery	71
`SSAE18-CC8.1`	CC8.1 - Infrastructure and Software Change Management	25
`SSAE18-CC9.1`	CC9.1 - Risk Mitigation Activities	0
`SSAE18-CC9.2`	CC9.2 - Vendor and Business Partner Risk Management	50
`SSAE18-P1.1`	P1.1 - Privacy Notice	48
`SSAE18-P1.2`	P1.2 - Choice and Consent	48
`SSAE18-PI1.1`	PI1.1 - Processing Integrity Definition	97
`SSAE18-PI1.2`	PI1.2 - System Processing Completeness and Accuracy	0
`SSAE18-PI1.3`	PI1.3 - Processing Error Handling	0
`SSAE18-SOC1-01`	Control Environment	0
`SSAE18-SOC1-02`	Risk Assessment	72
`SSAE18-SOC1-03`	Information and Communication	0
`SSAE18-SOC1-04`	Monitoring Activities	1
`SSAE18-SOC1-05`	Control Activities for Financial Processing	4
`SSAE18-SOC1-06`	Transaction Processing Controls	33
`105-H01`	AT-C 105 Conduct of an Attestation Engagement in Accordance With the Attestation Standards (.14 to .24)	0
`105-H02`	AT-C 105 Acceptance and Continuance (.25 to .27)	0
`105-H03`	AT-C 105 Preconditions for an Attestation Engagement (.28 to .32)	0
`105-H04`	AT-C 105 Acceptance of a Change in the Terms of the Engagement (.33 to .34)	0
`105-H05`	AT-C 105 Using the Work of Participating Practitioners and Referred-to Practitioners (.35 to .36)	0
`105-H06`	AT-C 105 Quality Management: Engagement Resources (.37 to .39)	0
`105-H07`	AT-C 105 Quality Management: Leadership Responsibilities for Managing and Achieving Quality (.40 to .48)	0
`105-H08`	AT-C 105 Quality Management: Compliance With Relevant Ethical Requirements (.49 to .54)	0
`105-H09`	AT-C 105 Quality Management: Monitoring and Remediation, and Overall Responsibility (.55 to .56)	0
`105-H10`	AT-C 105 Engagement Documentation (.57 to .64)	0
`105-H11`	AT-C 105 Engagement Quality Review (.65)	0
`105-H12`	AT-C 105 Professional Skepticism and Professional Judgment (.66 to .68)	0
`105.14`	AT-C 105.14 Conduct of an Attestation Engagement in Accordance With the Attestation Standards	0
`105.15`	AT-C 105.15 Conduct of an Attestation Engagement in Accordance With the Attestation Standards	0
`105.16`	AT-C 105.16 Conduct of an Attestation Engagement in Accordance With the Attestation Standards	0
`105.17`	AT-C 105.17 Conduct of an Attestation Engagement in Accordance With the Attestation Standards	0
`105.18`	AT-C 105.18 Conduct of an Attestation Engagement in Accordance With the Attestation Standards	0
`105.19`	AT-C 105.19 Conduct of an Attestation Engagement in Accordance With the Attestation Standards	0
`105.20`	AT-C 105.20 Conduct of an Attestation Engagement in Accordance With the Attestation Standards	0
`105.21`	AT-C 105.21 Conduct of an Attestation Engagement in Accordance With the Attestation Standards	0
`105.22`	AT-C 105.22 Conduct of an Attestation Engagement in Accordance With the Attestation Standards	0
`105.23`	AT-C 105.23 Conduct of an Attestation Engagement in Accordance With the Attestation Standards	0
`105.24`	AT-C 105.24 Conduct of an Attestation Engagement in Accordance With the Attestation Standards	0
`105.25`	AT-C 105.25 Acceptance and Continuance	0
`105.26`	AT-C 105.26 Acceptance and Continuance	0
`105.27`	AT-C 105.27 Acceptance and Continuance	0
`105.28`	AT-C 105.28 Preconditions for an Attestation Engagement	0
`105.29`	AT-C 105.29 Preconditions for an Attestation Engagement	0
`105.30`	AT-C 105.30 Preconditions for an Attestation Engagement	0
`105.31`	AT-C 105.31 Preconditions for an Attestation Engagement	0
`105.32`	AT-C 105.32 Preconditions for an Attestation Engagement	0
`105.33`	AT-C 105.33 Acceptance of a Change in the Terms of the Engagement	0
`105.34`	AT-C 105.34 Acceptance of a Change in the Terms of the Engagement	0
`105.35`	AT-C 105.35 Using the Work of Participating Practitioners and Referred-to Practitioners	0
`105.36`	AT-C 105.36 Using the Work of Participating Practitioners and Referred-to Practitioners	0
`105.37`	AT-C 105.37 Quality Management: Engagement Resources	0
`105.38`	AT-C 105.38 Quality Management: Engagement Resources	0
`105.39`	AT-C 105.39 Quality Management: Engagement Resources	0
`105.40`	AT-C 105.40 Quality Management: Leadership Responsibilities for Managing and Achieving Quality	0
`105.41`	AT-C 105.41 Quality Management: Leadership Responsibilities for Managing and Achieving Quality	0
`105.42`	AT-C 105.42 Quality Management: Leadership Responsibilities for Managing and Achieving Quality	0
`105.43`	AT-C 105.43 Quality Management: Leadership Responsibilities for Managing and Achieving Quality	0
`105.44`	AT-C 105.44 Quality Management: Leadership Responsibilities for Managing and Achieving Quality	0
`105.45`	AT-C 105.45 Quality Management: Leadership Responsibilities for Managing and Achieving Quality	0
`105.46`	AT-C 105.46 Quality Management: Leadership Responsibilities for Managing and Achieving Quality	0
`105.47`	AT-C 105.47 Quality Management: Leadership Responsibilities for Managing and Achieving Quality	0
`105.48`	AT-C 105.48 Quality Management: Leadership Responsibilities for Managing and Achieving Quality	0
`105.49`	AT-C 105.49 Quality Management: Compliance With Relevant Ethical Requirements	0
`105.50`	AT-C 105.50 Quality Management: Compliance With Relevant Ethical Requirements	0
`105.51`	AT-C 105.51 Quality Management: Compliance With Relevant Ethical Requirements	0
`105.52`	AT-C 105.52 Quality Management: Compliance With Relevant Ethical Requirements	0
`105.53`	AT-C 105.53 Quality Management: Compliance With Relevant Ethical Requirements	0
`105.54`	AT-C 105.54 Quality Management: Compliance With Relevant Ethical Requirements	0
`105.55`	AT-C 105.55 Quality Management: Monitoring and Remediation, and Overall Responsibility	0
`105.56`	AT-C 105.56 Quality Management: Monitoring and Remediation, and Overall Responsibility	0
`105.57`	AT-C 105.57 Engagement Documentation	0
`105.58`	AT-C 105.58 Engagement Documentation	0
`105.59`	AT-C 105.59 Engagement Documentation	0
`105.60`	AT-C 105.60 Engagement Documentation	0
`105.61`	AT-C 105.61 Engagement Documentation	0
`105.62`	AT-C 105.62 Engagement Documentation	0
`105.63`	AT-C 105.63 Engagement Documentation	0
`105.64`	AT-C 105.64 Engagement Documentation	0
`105.65`	AT-C 105.65 Engagement Quality Review	0
`105.66`	AT-C 105.66 Professional Skepticism and Professional Judgment	0
`105.67`	AT-C 105.67 Professional Skepticism and Professional Judgment	0
`105.68`	AT-C 105.68 Professional Skepticism and Professional Judgment	0
`205-H01`	AT-C 205 Conduct of an Examination Engagement (.05)	0
`205-H02`	AT-C 205 Preconditions for an Examination Engagement (.06)	0
`205-H03`	AT-C 205 Agreeing on the Terms of the Engagement (.07 to .09)	0
`205-H04`	AT-C 205 Requesting a Written Assertion (.10)	0
`205-H05`	AT-C 205 Planning and Performing the Engagement (.11 to .13)	0
`205-H06`	AT-C 205 Risk Assessment Procedures (.14 to .16)	0
`205-H07`	AT-C 205 Materiality in Planning and Performing the Engagement (.17 to .18)	0
`205-H08`	AT-C 205 Identifying Risks of Material Misstatement (.19)	0
`205-H09`	AT-C 205 Responding to Assessed Risks and Obtaining Evidence (.20 to .21)	0
`205-H10`	AT-C 205 Further Procedures (.22 to .32)	0
`205-H11`	AT-C 205 Fraud, Laws, and Regulations (.33 to .34)	0
`205-H12`	AT-C 205 Revision of Risk Assessment (.35)	0
`205-H13`	AT-C 205 Evaluating the Reliability of Information Produced by the Entity (.36)	0
`205-H14`	AT-C 205 Using the Work of a Practitioner's Specialist (.37 to .39)	0
`205-H15`	AT-C 205 Using the Work of Internal Auditors (.40 to .45)	0
`205-H16`	AT-C 205 Evaluating the Results of Procedures (.46 to .48)	0
`205-H17`	AT-C 205 Considering Subsequent Events and Subsequently Discovered Facts (.49 to .50)	0
`205-H18`	AT-C 205 Written Representations (.51 to .55)	0
`205-H19`	AT-C 205 Requested Written Representations Not Provided or Not Reliable (.56 to .57)	0
`205-H20`	AT-C 205 Other Information (.58)	0
`205-H21`	AT-C 205 Description of Criteria (.59)	0
`205-H22`	AT-C 205 Forming the Opinion (.60 to .61)	0
`205-H23`	AT-C 205 Preparing the Practitioner's Report (.62 to .68)	0
`205-H24`	AT-C 205 Reference to the Practitioner's Specialist (.69)	0
`205-H25`	AT-C 205 Modified Opinions (.70 to .83)	0
`205-H26`	AT-C 205 Responsible Party Refuses to Provide a Written Assertion (.84 to .86)	0
`205-H27`	AT-C 205 Communication Responsibilities (.87 to .88)	0
`205-H28`	AT-C 205 Documentation (.89 to .90)	0
`205.05`	AT-C 205.05 Conduct of an Examination Engagement	0
`205.06`	AT-C 205.06 Preconditions for an Examination Engagement	0
`205.07`	AT-C 205.07 Agreeing on the Terms of the Engagement	0
`205.08`	AT-C 205.08 Agreeing on the Terms of the Engagement	0
`205.09`	AT-C 205.09 Agreeing on the Terms of the Engagement	0
`205.10`	AT-C 205.10 Requesting a Written Assertion	0
`205.11`	AT-C 205.11 Planning and Performing the Engagement	0
`205.12`	AT-C 205.12 Planning and Performing the Engagement	0
`205.13`	AT-C 205.13 Planning and Performing the Engagement	0
`205.14`	AT-C 205.14 Risk Assessment Procedures	0
`205.15`	AT-C 205.15 Risk Assessment Procedures	0
`205.16`	AT-C 205.16 Risk Assessment Procedures	0
`205.17`	AT-C 205.17 Materiality in Planning and Performing the Engagement	0
`205.18`	AT-C 205.18 Materiality in Planning and Performing the Engagement	0
`205.19`	AT-C 205.19 Identifying Risks of Material Misstatement	0
`205.20`	AT-C 205.20 Responding to Assessed Risks and Obtaining Evidence	0
`205.21`	AT-C 205.21 Responding to Assessed Risks and Obtaining Evidence	0
`205.22`	AT-C 205.22 Further Procedures	0
`205.23`	AT-C 205.23 Further Procedures	0
`205.24`	AT-C 205.24 Further Procedures	0
`205.25`	AT-C 205.25 Further Procedures	0
`205.26`	AT-C 205.26 Further Procedures	0
`205.27`	AT-C 205.27 Further Procedures	0
`205.28`	AT-C 205.28 Further Procedures	0
`205.29`	AT-C 205.29 Further Procedures	0
`205.30`	AT-C 205.30 Further Procedures	0
`205.31`	AT-C 205.31 Further Procedures	0
`205.32`	AT-C 205.32 Further Procedures	0
`205.33`	AT-C 205.33 Fraud, Laws, and Regulations	0
`205.34`	AT-C 205.34 Fraud, Laws, and Regulations	0
`205.35`	AT-C 205.35 Revision of Risk Assessment	0
`205.36`	AT-C 205.36 Evaluating the Reliability of Information Produced by the Entity	0
`205.37`	AT-C 205.37 Using the Work of a Practitioner's Specialist	0
`205.38`	AT-C 205.38 Using the Work of a Practitioner's Specialist	0
`205.39`	AT-C 205.39 Using the Work of a Practitioner's Specialist	0
`205.40`	AT-C 205.40 Using the Work of Internal Auditors	0
`205.41`	AT-C 205.41 Using the Work of Internal Auditors	0
`205.42`	AT-C 205.42 Using the Work of Internal Auditors	0
`205.43`	AT-C 205.43 Using the Work of Internal Auditors	0
`205.44`	AT-C 205.44 Using the Work of Internal Auditors	0
`205.45`	AT-C 205.45 Using the Work of Internal Auditors	0
`205.46`	AT-C 205.46 Evaluating the Results of Procedures	0
`205.47`	AT-C 205.47 Evaluating the Results of Procedures	0
`205.48`	AT-C 205.48 Evaluating the Results of Procedures	0
`205.49`	AT-C 205.49 Considering Subsequent Events and Subsequently Discovered Facts	0
`205.50`	AT-C 205.50 Considering Subsequent Events and Subsequently Discovered Facts	0
`205.51`	AT-C 205.51 Written Representations	0
`205.52`	AT-C 205.52 Written Representations	0
`205.53`	AT-C 205.53 Written Representations	0
`205.54`	AT-C 205.54 Written Representations	0
`205.55`	AT-C 205.55 Written Representations	0
`205.56`	AT-C 205.56 Requested Written Representations Not Provided or Not Reliable	0
`205.57`	AT-C 205.57 Requested Written Representations Not Provided or Not Reliable	0
`205.58`	AT-C 205.58 Other Information	0
`205.59`	AT-C 205.59 Description of Criteria	0
`205.60`	AT-C 205.60 Forming the Opinion	0
`205.61`	AT-C 205.61 Forming the Opinion	0
`205.62`	AT-C 205.62 Preparing the Practitioner's Report	0
`205.63`	AT-C 205.63 Preparing the Practitioner's Report	0
`205.64`	AT-C 205.64 Preparing the Practitioner's Report	0
`205.65`	AT-C 205.65 Preparing the Practitioner's Report	0
`205.66`	AT-C 205.66 Preparing the Practitioner's Report	0
`205.67`	AT-C 205.67 Preparing the Practitioner's Report	0
`205.68`	AT-C 205.68 Preparing the Practitioner's Report	0
`205.69`	AT-C 205.69 Reference to the Practitioner's Specialist	0
`205.70`	AT-C 205.70 Modified Opinions	0
`205.71`	AT-C 205.71 Modified Opinions	0
`205.72`	AT-C 205.72 Modified Opinions	0
`205.73`	AT-C 205.73 Modified Opinions	0
`205.74`	AT-C 205.74 Modified Opinions	0
`205.75`	AT-C 205.75 Modified Opinions	0
`205.76`	AT-C 205.76 Modified Opinions	0
`205.77`	AT-C 205.77 Modified Opinions	0
`205.78`	AT-C 205.78 Modified Opinions	0
`205.79`	AT-C 205.79 Modified Opinions	0
`205.80`	AT-C 205.80 Modified Opinions	0
`205.81`	AT-C 205.81 Modified Opinions	0
`205.82`	AT-C 205.82 Modified Opinions	0
`205.83`	AT-C 205.83 Modified Opinions	0
`205.84`	AT-C 205.84 Responsible Party Refuses to Provide a Written Assertion	0
`205.85`	AT-C 205.85 Responsible Party Refuses to Provide a Written Assertion	0
`205.86`	AT-C 205.86 Responsible Party Refuses to Provide a Written Assertion	0
`205.87`	AT-C 205.87 Communication Responsibilities	0
`205.88`	AT-C 205.88 Communication Responsibilities	0
`205.89`	AT-C 205.89 Documentation	0
`205.90`	AT-C 205.90 Documentation	0
`320-H01`	AT-C 320 Management and Those Charged With Governance (.09)	0
`320-H02`	AT-C 320 Preconditions (.10 to .12)	0
`320-H03`	AT-C 320 Requesting a Written Assertion (.13)	0
`320-H04`	AT-C 320 Assessing the Suitability of the Criteria (.14 to .18)	0
`320-H05`	AT-C 320 Materiality (.19)	0
`320-H06`	AT-C 320 Obtaining an Understanding of the Service Organization's System and Assessing the Risk of Material Misstatement (.20 to .23)	0
`320-H07`	AT-C 320 Responding to Assessed Risks and Further Procedures (.24)	0
`320-H08`	AT-C 320 Obtaining Evidence Regarding Management's Description of the Service Organization's System (.25 to .26)	0
`320-H09`	AT-C 320 Obtaining Evidence Regarding the Design of Controls (.27)	0
`320-H10`	AT-C 320 Obtaining Evidence Regarding the Operating Effectiveness of Controls (.28 to .34)	0
`320-H11`	AT-C 320 Subsequent Events (.35)	0
`320-H12`	AT-C 320 Written Representations (.36 to .38)	0
`320-H13`	AT-C 320 Other Information (.39)	0
`320-H14`	AT-C 320 Content of the Service Auditor's Report (.40 to .41)	0
`320-H15`	AT-C 320 Modified Opinions (.42 to .44)	0
`320-H16`	AT-C 320 Other Communication Responsibilities (.45)	0
`320.09`	AT-C 320.09 Management and Those Charged With Governance	0
`320.10`	AT-C 320.10 Preconditions	0
`320.11`	AT-C 320.11 Preconditions	0
`320.12`	AT-C 320.12 Preconditions	0
`320.13`	AT-C 320.13 Requesting a Written Assertion	0
`320.14`	AT-C 320.14 Assessing the Suitability of the Criteria	0
`320.15`	AT-C 320.15 Assessing the Suitability of the Criteria	0
`320.16`	AT-C 320.16 Assessing the Suitability of the Criteria	0
`320.17`	AT-C 320.17 Assessing the Suitability of the Criteria	0
`320.18`	AT-C 320.18 Assessing the Suitability of the Criteria	0
`320.19`	AT-C 320.19 Materiality	0
`320.20`	AT-C 320.20 Obtaining an Understanding of the Service Organization's System and Assessing the Risk of Material Misstatement	0
`320.21`	AT-C 320.21 Obtaining an Understanding of the Service Organization's System and Assessing the Risk of Material Misstatement	0
`320.22`	AT-C 320.22 Obtaining an Understanding of the Service Organization's System and Assessing the Risk of Material Misstatement	0
`320.23`	AT-C 320.23 Obtaining an Understanding of the Service Organization's System and Assessing the Risk of Material Misstatement	0
`320.24`	AT-C 320.24 Responding to Assessed Risks and Further Procedures	0
`320.25`	AT-C 320.25 Obtaining Evidence Regarding Management's Description of the Service Organization's System	0
`320.26`	AT-C 320.26 Obtaining Evidence Regarding Management's Description of the Service Organization's System	0
`320.27`	AT-C 320.27 Obtaining Evidence Regarding the Design of Controls	0
`320.28`	AT-C 320.28 Obtaining Evidence Regarding the Operating Effectiveness of Controls	0
`320.29`	AT-C 320.29 Obtaining Evidence Regarding the Operating Effectiveness of Controls	0
`320.30`	AT-C 320.30 Obtaining Evidence Regarding the Operating Effectiveness of Controls	0
`320.31`	AT-C 320.31 Obtaining Evidence Regarding the Operating Effectiveness of Controls	0
`320.32`	AT-C 320.32 Obtaining Evidence Regarding the Operating Effectiveness of Controls	0
`320.33`	AT-C 320.33 Obtaining Evidence Regarding the Operating Effectiveness of Controls	0
`320.34`	AT-C 320.34 Obtaining Evidence Regarding the Operating Effectiveness of Controls	0
`320.35`	AT-C 320.35 Subsequent Events	0
`320.36`	AT-C 320.36 Written Representations	0
`320.37`	AT-C 320.37 Written Representations	0
`320.38`	AT-C 320.38 Written Representations	0
`320.39`	AT-C 320.39 Other Information	0
`320.40`	AT-C 320.40 Content of the Service Auditor's Report	0
`320.41`	AT-C 320.41 Content of the Service Auditor's Report	0
`320.42`	AT-C 320.42 Modified Opinions	0
`320.43`	AT-C 320.43 Modified Opinions	0
`320.44`	AT-C 320.44 Modified Opinions	0
`320.45`	AT-C 320.45 Other Communication Responsibilities	0
`AMENDMENTS`	The amendments since 2016 and the current numbering of AT-C 105 and 205	0
`AT-C 105`	AT-C 105: Concepts Common to All Attestation Engagements	0
`AT-C 205`	AT-C 205: Assertion-Based Examination Engagements	0
`AT-C 320`	AT-C 320: Reporting on an Examination of Controls at a Service Organization	0
`OTHER-SECTIONS`	The other AT-C sections: 206 direct examination, 210 review, 215 agreed-upon procedures, 305, 310 and 315, and AT section 701	0
`SOC`	How SOC 1, SOC 2 and SOC 3 reports sit on these sections, and the 2026 exposure draft	0
`STANDARD`	SSAE No. 18: the clarified and recodified attestation standards, and what is held	0

Tell me when SSAE 18 files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Privacy notice and versioning
Choice and consent records
Data subject request logs
Personal information inventory
Confidential information inventory
Encryption configuration baselines
Monitoring configuration and alert rules
Anomaly detection logs
Security event evaluation records
Incident response playbooks

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

Inventory incomplete named by 6 frameworks
Recovery untested named by 5 frameworks
Consent not granular named by 3 frameworks
Disposal undocumented named by 3 frameworks

What this page is

A control-level reference for SSAE 18, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition