Your security and compliance glossary

All the terms you need to know when you’re trying to get compliance audit ready, fast.

Show filters

What is SOC 1?

A Service Organization Control 1 or SOC 1 report is documentation of the internal controls that are likely to be relevant to an audit of a customer's financial statements.

There are two types of reports for these engagements:


  • Type 1 – report on the fairness of the presentation of management’s description of the service organization’s system and the suitability of the design of the controls to achieve the related control objectives included in the description as of a specified date.
  • Type 2 - report on the fairness of the presentation of management’s description of the service organization’s system and the suitability of the design and operating effectiveness of the controls to achieve the related control objectives included in the description throughout a specified period.


Use of these reports is restricted to,  your company, your customers, and your auditors. If you’d like a report you can share publicly, you may want a SOC 3.

Additional resources you might like:

Comparisons and reviews
Blog
The best TPRM software for 2026

Discover the best third-party risk management software solutions for 2026.

Comparisons and reviews
Blog
Top 5 OneTrust alternatives

Check out top OneTrust alternatives for compliance and risk management.

Comparisons and reviews
Blog
Top 4 Secureframe alternatives

Explore features, limitations, and scalable compliance solutions.

Additional resources you might like:

Comparisons and reviews
Blog
The best TPRM software for 2026

Discover the best third-party risk management software solutions for 2026.

Comparisons and reviews
Blog
Top 5 OneTrust alternatives

Check out top OneTrust alternatives for compliance and risk management.

Comparisons and reviews
Blog
Top 4 Secureframe alternatives

Explore features, limitations, and scalable compliance solutions.

Vendor Risk Management
Blog
GDPR, NIS 2, and DORA converge on one problem: Third-party risk

Discover how EU regulations, GDPR, NIS 2, and DORA, make third-party risk a direct, continuous business liability. Find out why most teams still lack visibility.

Compliance
Blog
How to become PCI compliant in three steps

Being PCI compliant can mean different requirements for merchants and service providers. Learn how to become PCI compliant in three easy steps.

Product updates
Events
Vanta Delivers: Live from New York

Join us to see new product capabilities and live demos, and learn how Vanta is delivering a unified risk experience for GRC teams.

Vendor Risk Management
Events
AI broke your Third Party Risk Management program. Now what?

Watch on demand to learn where traditional TPRM breaks down in an AI-first world, and how one team rebuilt their program to actually keep up.

Compliance
Events
Learn how to automate compliance for SOC 2, ISO 27001, and more

Watch on demand to learn how Vanta’s Agentic Trust Platform helps fast-moving startups and security teams get audit-ready fast and stay continuously compliant.

Compliance
Blog
How do you perform quarterly access reviews?

Without periodic access reviews, former employees may retain access to sensitive data after termination. Learn how to perform effective quarterly access reviews.