• contact@verticalserve.com
  • Continuous compliance, proven every hour
Request a demo
SOC 1

Your control objectives. Their CUECs. The cloud’s CSOCs.

SOC 1 has no prescribed criteria: management writes the control objectives. InsightAssure makes them your own editable rows, and keeps the complementary controls on both sides of the report in the system description.

FrameworksMonitoringIntegrationsPeople & devicesPoliciesVendors & riskAccess reviewsAuditsSOC 1Trust CenterAI questionnairesConsultancies
Control objectives

Thirteen to start, every one yours

The template set covers IT general controls (logical access, change management, system development, computer operations, backup and recovery, physical and environmental security, data transmission and network security, incident management, subservice organization monitoring) and business processes (client onboarding and master data, transaction input, processing, and output). Rename, rewrite, take out of scope with a reason, or add your own; each maps to unified controls like any other requirement.

app.insightassure.com/frameworks/soc1
SOC 1 framework page on the System description tab: 15% ready, 13 control objectives, and editable sections for company overview, services provided, principal service commitments and system boundaries, with Draft with AI and Save buttons.
Section III, the system description, drafted from what InsightAssure already knows and then edited.
Complementary controls

CUECs and CSOCs, worded the way reports word them

What it isDefault example in InsightAssure
CUECA control your customers (user entities) must operate for your controls to achieve their objectives“User entities are responsible for removing access for their terminated users in a timely manner.” (CO-01)
CSOCA control you assume a carved-out subservice organization operates“The cloud hosting provider is responsible for restricting physical access to data center facilities… to authorized personnel.” (CO-06)

Seven default CUECs and four default CSOCs ship with the SOC 1 template, each tied to the objectives it supports; all are editable.

Subservice organizations

Carved out, and still monitored

A vendor marked as a subservice organization records the method (carve-out or inclusive) and the CSOCs assumed of it. Its SOC report review records the opinion and expiry, and the vendors.soc_reports_current monitor fails when the report on file has expired, which is what CO-09 and VND-05 ask you to show.

app.insightassure.com/vendors/aws
Amazon Web Services vendor page: critical, inherent risk high, SOC 2 Type 2 report with unqualified opinion, period end Aug 10, 2026, expires Aug 10, 2027; a complementary subservice organization controls section with ‘Physical and environmental security of data centers’; one completed SOC report review.
AWS as a carved-out subservice organization: its SOC 2 report is on file with its expiry, and the CSOC your own report assumes AWS operates is recorded beside it.
How it works

Where each control sits in a SOC 1 report

Where each control sits in a SOC 1 report 1User entitiesYour customersoperate the CUECs:their users, theirinputs, their reviewof outputs.2ControlobjectivesWritten by yourmanagement; eachmapped to unifiedcontrols.3Your controlsTested by monitorsand evidence, then bythe auditor.4Subservice orgsCarved out; theirCSOCs recorded, theirSOC reports reviewed.5SystemdescriptionSection III brings ittogether; drafted,then edited.Where each control sits in a SOC 1 report 1User entitiesYour customers operate the CUECs:their users, their inputs, theirreview of outputs.2Control objectivesWritten by your management; eachmapped to unified controls.3Your controlsTested by monitors and evidence,then by the auditor.4Subservice orgsCarved out; their CSOCs recorded,their SOC reports reviewed.5System descriptionSection III brings it together;drafted, then edited.
SOC 1 and SOC 2 share the unified controls, so most of a SOC 2 program already serves SOC 1.
Questions it answers

What you can find out

Each one is answered on a screen you can open, and most can be typed into Ask Assure as they are.

Which objectives are not yet achieved?SOC 1 requirements in progress, with their controls
What must our customers do?The system description’s CUECs
What do we assume AWS does?The CSOCs on the vendor and in the description
Is our cloud provider’s SOC report current?Subservice organizations’ SOC reports are current
Which controls are key controls?The control matrix’s Key markers
Draft our system descriptionDraft with AI from connected systems, people and vendors
Outcomes

What teams do with it

SOC 1 and SOC 2 from one program

Shared controls, separate objectives and criteria.

CUECs your customers can act on

Worded clearly, tied to objectives.

Carve-outs that hold up

Subservice reports reviewed and current.

Where it stops. The template objectives are a starting point for a technology service organization; your auditor and management decide the final wording. InsightAssure does not write the auditor’s section IV or the opinion.
Vendors & risk Auditor workspace Frameworks & controls Fintech & payroll

Scope your SOC 1

We adopt the template objectives with you and rewrite the business-process ones around your transaction flow.

Request a demo