Name two assurance reports commonly used in vendor risk assessments.

• A. SOC 2 Type II and ISO 27001 certification/audit reports
• B. PCI DSS Level 1 and SOC 1
• C. HIPAA compliance letter and CSA
• D. ISO 9001 and ITIL report

Answer: (A)

In vendor risk assessments, you want independent attestations that confirm a provider has effective controls around information security. A SOC 2 Type II report demonstrates that a service organization's controls are not only designed appropriately but also operating effectively over a period, based on the Trust Services Criteria of security, availability, processing integrity, confidentiality, and privacy. An ISO 27001 certification or audit shows the provider has established and is maintaining an information security management system aligned with the ISO 27001 standard, offering a globally recognized assurance of how security is managed across the organization.

These two reports are commonly relied upon because they provide verifiable, third-party assurance of security-related controls that are applicable across many industries and service types, especially for cloud and outsourcing arrangements.

Other options don’t fit as broadly for vendor risk assessments: PCI DSS Level 1 targets payment card data protection rather than general security controls; SOC 1 focuses on controls relevant to financial reporting rather than information security; HIPAA compliance letters are specific to protected health information; CSA refers to cloud security guidance rather than a formal assurance report; ISO 9001 concentrates on quality management and ITIL is a service management framework, not formal security attestations.