Which of the following is true of Service Organization Control (SOC) reports?

SOC 1 reports specifically assess internal controls over financial reporting (ICFR), not security, confidentiality, integrity, and availability - those Trust Services Criteria are evaluated under SOC 2 reports.

SOC 2 Type 2 reports evaluate the operating effectiveness of controls related to security, availability, processing integrity, confidentiality, and privacy over a defined period of time. These reports are intended for a broad audience including management, customers, and business partners who need detailed information about the service organization's controls, making it accurate that they include information of interest to the service organization's management and its user entities.

SOC 2 reports assess controls related to the AICPA Trust Services Criteria (security, availability, processing integrity, confidentiality, and privacy), not internal controls for financial reporting, which is the scope of SOC 1 reports.

There is no 'SOC 3 Type 2' classification - SOC 3 reports are general-use summary reports based on the same Trust Services Criteria as SOC 2 but do not contain the detailed control descriptions, and they do not assess internal controls for financial reporting.