Which kind of SSAE audit reviews controls dealing with the organization’s controls for assuring the confidentiality, integrity, and availability of data?

The American Institute of Certified Public Accountants (AICPA) defines the Service Organization Control (SOC) reports. A SOC 2 report is specifically designed to provide assurance about a service organization's controls based on the Trust Services Criteria. These criteria are Security, Availability, Processing Integrity, Confidentiality, and Privacy. The question directly asks for the audit that reviews controls for confidentiality, integrity, and availability, which are three of the five Trust Services Criteria, making SOC 2 the correct answer.

A. SOC 1 reports focus on a service organization's controls that are relevant to a user entity's internal control over financial reporting (ICFR).
C. SOC 3 is a general-use, high-level summary of the SOC 2 report. While it covers the same criteria, the SOC 2 is the detailed audit review itself.
D. SOC 4 is not a standard, currently defined report type within the primary SSAE framework alongside SOC 1, 2, and 3.

1. AICPA. (2017). SOC 2® - SOC for Service Organizations: Trust Services Criteria. The official AICPA guidance defines the scope of a SOC 2 engagement as reporting on controls relevant to the Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, and Privacy).

2. Official (ISC)² Guide to the CCSP CBK, 5th Edition. Chapter 1, "Cloud Concepts, Architecture, and Design," details audit reports, stating, "A SOC 2 report is concerned with the service provider’s controls, related to the AICPA Trust Services Criteria (TSC)."

3. Cloud Security Alliance (CSA). (2017). Security Guidance for Critical Areas of Focus in Cloud Computing v4.0. Domain 2, "Governance and Enterprise Risk Management," page 32, describes SOC 2 as the report that "evaluates the service provider’s controls against the CSA Cloud Controls Matrix (CCM) and the AICPA Trust Service Principles."