Which kind of SSAE audit reviews controls dealing with the organization's controls for assuring the confidentiality, integrity, and availability of data? Response:

SOC 1 reports primarily focus on internal controls over financial reporting (ICFR) and do not specifically address data security, availability, and confidentiality.

A SOC 2 (Service Organization Control 2) audit report focuses on a service organization's controls relevant to the security, availability, processing integrity, confidentiality, and privacy of the data it processes for its users. These are collectively known as the Trust Services Criteria (TSC), directly addressing the confidentiality, integrity, and availability (CIA) of data.

SOC 3 reports are general use reports that provide a less detailed, publicly available version of a SOC 2 report, without the detailed description of the system or the controls.

SOC 4 is not a recognized or standard SSAE audit report type.