What is SOC 1?
SOC 1 (System and Organization Controls 1) is an audit report that provides insight into internal controls relevant to the financial reporting of customers. It is prepared in accordance with the ISAE 3402 standard and is intended for organisations that deliver business-critical services with an impact on financial processes.
In the OT context, SOC 1 is relevant for service providers that automate or manage processes that influence financial output, such as production volumes, traceability, or Compliance with quality standards.
🧠 Key characteristics of SOC 1
- Scope: financial impact – Focused on processes that affect financial statements, audit trails, and compliance
- Type I vs Type II – Type I describes the design at a specific point in time; Type II also assesses operating effectiveness over a period
- Based on ISAE 3402 – SOC 1 is the US (AICPA) implementation of ISAE 3402
- Reporting to auditors – Aimed at the customer’s internal and external financial auditors
- Control objectives – Covering authorisations, completeness of data, consistency of processes
- Not intended for IT security – SOC 2 or ISO 27001 is more appropriate for that
🔐 SOC 1 in OT/IT convergence
| Example process | Financial relevance in the OT context |
|---|---|
| Production counting via SCADA | Output figures determine inventory value or invoicing |
| Batch registration and Tracking and Tracing | Important for quality and certification accountability |
| Historian data logging | Substantiation of production quantities or downtime accountability |
| Automated Alarm Management | Recording of faults that cause production loss or damage |
| Integration with ERP | Flow of production data into financial systems |
SOC 1 does not focus primarily on cyber risks, but it can indicate whether processes are complete, accurate, and timely.
✅ Common SOC 1 controls
| Control area | Example in the OT context |
|---|---|
| Access management | Only authorised engineers may amend recipes or export batch data |
| Logging and monitoring | Production data is automatically captured and verified |
| Processing completeness | All production units are logged and validated in MES or Historian |
| Change management | Changes to recipe data or configurations follow approved procedures |
| Incident management | Downtime and deviations are recorded and escalated per protocol |
🔁 SOC 1 vs. other standards
| Standard | Focus |
|---|---|
| SOC 1 | Internal controls with an impact on financial reporting |
| SOC 2 | Trust Services Criteria: security, availability, privacy |
| ISAE 3402 | International equivalent of SOC 1 (often Type II) |
| ISO 27001 | Information security and risk management |
| IEC 62443-2-4 | OT suppliers and system integrators |
📦 SOC 1 in IT vs. OT
| SOC 1 in IT | SOC 1 in OT |
|---|---|
| Payroll processing, hosting services | Automatic recording of output/production |
| Financial transactions in SaaS | Determining production costs via batch data or machine hours |
| ERP management and invoicing systems | Coupling between OT (process data) and ERP for invoicing/logistics |
SOC 1 is essential when OT services have an impact on financial administration or reporting, for example in pharma, food, or energy.
📌 In summary
SOC 1 provides customers and auditors with assurance over financial process control at suppliers. In OT environments, SOC 1 matters for production volumes, traceability, and integration with ERP/financial systems, especially when these are managed by external parties.