• Gives the opinion of the independent auditor

Section Two: Description of Controls

• Detailed description of the controls in place around the specific processes covered by the report (these controls are identified by and are the responsibility of the service organization) 

Section Three: Description of Tests and Results

• Detailed description of the tests performed to ensure controls are operating effectively
• Results of the tests performed over the period covered by the report

Section Four: Additional information provided by the Service Organization (optional)

• Any additional information that the service organization would like to provide on the company's operations (i.e., Business Continuity and Disaster Recovery/Build-out Plans)