The RSI Security weblog breaks down the measures in certain depth, but the process in essence goes like this: Features a new illustrative report Which might be made use of when performing and reporting over a SOC two+ examination. A SOC two examination is actually a report on controls at https://www.nathanlabsadvisory.com/blog/tag/penetration-testing/