The RSI Security website breaks down the techniques in certain element, but the process in essence goes similar to this: SOC compliance is created to show to the service company’s consumers that a company can provide the services that it's contracted for. Normally, a company’s clients don't have deep visibility https://www.nathanlabsadvisory.com/nist-800-171.html