{"page":"/tools/commerce-media-platform-rfp","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Item","Question","Why it matters","A good answer contains"],"rows":[["G1 (gate)","Provide your latest SOC 2 Type 2 report: period, auditor, scope and exceptions.","The AICPA is looking into allegations about one SOC services provider, and its journal has covered the risks of quick-turn SOC engagements (AICPA, accessed 9 Nov 2026).","A Type 2 report covering the systems in scope, a recent period, a named CPA firm and remediation of exceptions."],["G2","Which Trust Services Criteria are in scope, and how will you move to the 2027 criteria?","SOC 2 can cover security, availability, processing integrity, confidentiality and privacy; the 2027 criteria are in draft (AICPA).","The categories covered and a transition plan."],["G3","Who manages encryption keys, and can we hold our own?","Customer-held keys limit what the vendor can read.","Key management design and customer-managed key support."],["G4","Which subprocessors and regions handle our data?","Each subprocessor is another party to assess.","A current list and advance notice of changes."],["G5","What are your incident response and notification commitments?","Banks have their own notification duties to meet.","Notification time in hours, named contacts and recent exercise results."]],"sourceUrls":[["https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2"],["https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2"],[],[],[]]}