Reading Vendor SOC 2 Reports and Penetration Test Reports

IntermediateFree5 modules · 15 lessons

About this course

A practical guide to reading a vendor's System and Organization Controls 2 (SOC 2) report and penetration test report as received evidence, distinct from the broader vendor risk programme covered in tprm-essentials-onboarding-vendors and vendor-risk-scoring-methodology. You will learn to distinguish Type I from Type II reports, read an auditor's opinion and scope statement carefully, understand complementary user entity controls, apply the same practical scepticism to a penetration test report's scope and date, recognise the specific red flags that recur across both document types, and use these documents as one input into a broader risk score rather than a pass or fail gate. Every scenario in this course is a clearly labelled hypothetical; no real vendor, auditor, or report is described.

What you'll learn

Reading a SOC 2 Report as Received Evidence

Type I Versus Type II: What Each Report Actually Attests To
Reading the Auditor's Opinion Section
Scope and Trust Services Criteria: What the Report Actually Covers

Complementary Controls and Reading a Penetration Test Report

Complementary User Entity Controls: The Customer's Own Responsibilities
Reading a Penetration Test Report: Scope and Date First
What a Penetration Test Report Actually Demonstrates and Does Not

Red Flags Common to Both Document Types

Red Flag One: An Unusually Old Report
Red Flag Two: An Undisclosed Scope Limitation
Red Flag Three: A Recurring Finding Never Actually Remediated

01Reading a SOC 2 Report as Received Evidence3 lessons

Type I Versus Type II: What Each Report Actually Attests To
Reading the Auditor's Opinion Section
Scope and Trust Services Criteria: What the Report Actually Covers

02Complementary Controls and Reading a Penetration Test Report3 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

Using These Documents in a Broader Risk Process

One Input Among Several, Not a Pass or Fail Gate
What to Do When a Vendor Cannot or Will Not Produce Either Document
Bringing the Reading Discipline Together: A Practical Review Walkthrough

Building an Organisational Habit Around These Documents

Who Should Actually Read These Reports
A Short Standing Checklist for Every Review
Closing the Course: Reading Evidence With Practical Scepticism, Not Cynicism

Complementary User Entity Controls: The Customer's Own Responsibilities

Reading a Penetration Test Report: Scope and Date First

What a Penetration Test Report Actually Demonstrates and Does Not

03Red Flags Common to Both Document Types3 lessons

Red Flag One: An Unusually Old Report
Red Flag Two: An Undisclosed Scope Limitation
Red Flag Three: A Recurring Finding Never Actually Remediated

04Using These Documents in a Broader Risk Process3 lessons

One Input Among Several, Not a Pass or Fail Gate
What to Do When a Vendor Cannot or Will Not Produce Either Document
Bringing the Reading Discipline Together: A Practical Review Walkthrough

05Building an Organisational Habit Around These Documents3 lessons

Who Should Actually Read These Reports
A Short Standing Checklist for Every Review
Closing the Course: Reading Evidence With Practical Scepticism, Not Cynicism

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.