When conducting a third-party risk assessment of a new supplier, which of the following reports should be reviewed to confirm the operating effectiveness of the security, availability, confidentiality

SOC 1 Type 2 reports focus exclusively on internal controls over financial reporting (ICFR) and are not designed to assess security, availability, confidentiality, or privacy trust principles.

SOC 2 Type 2 reports are issued by independent auditors and assess a service organization's controls against the AICPA Trust Services Criteria (TSC), which explicitly include security, availability, confidentiality, processing integrity, and privacy. The 'Type 2' designation confirms that the report covers operating effectiveness of those controls over a historical period (typically 6-12 months), not just their design, making it the ideal evidence for a third-party risk assessment of a supplier.

ISO 27001 is a certification that confirms an organization has implemented an Information Security Management System (ISMS) meeting the standard's requirements, but it does not provide detailed evidence of operating effectiveness across availability, confidentiality, and privacy trust principles in the same structured way as a SOC 2 Type 2.

ISO 27002 is a code of practice providing guidelines and best practices for information security controls, but it is not an audit report or certification and therefore cannot confirm the operating effectiveness of any controls at a supplier.