It problems suggestions on how to interpret core ideas in the GDPR and can concern binding selections dealt with to the info security authorities on dispute in concrete circumstances regarding cross-border processing. The distinction between the different types of SOC audits lies inside the scope and length on the assessment: https://www.nathanlabsadvisory.com/hitrust.html