The RSI security weblog breaks down the ways in some depth, but the method in essence goes similar to this: The distinction between the different types of SOC audits lies while in the scope and period of the assessment: The security posture of the Corporation is assessed dependant on SOC https://www.nathanlabsadvisory.com/bespoke-training.html