Definition
AICPA DC section 200 · 2018 Description Criteria (revised implementation guidance 2022)Section 3 of a SOC 2 report, written by the service organisation's management, describing the system in scope: services, infrastructure, software, people, data and processes, the control environment, the controls that meet each criterion, subservice organisations, and the controls you expect customers to operate. The auditor gives an opinion on whether it is fairly presented against the AICPA's description criteria. It is where a reader learns what the report does and does not cover.
Also called Section 3management's description of the system