This assessment is purely qualitative. Thus, it is conducted by way of questionnaire and/or interview processes to examine five major areas: Management Responsibilities Risk Management Contract Issues Ongoing Monitoring SOC Report Evaluations and Gap Assessment