Which of the following is true of a SOC 2 engagement? 

a. The report resulting from a SOC 2 engagement can be made available for general use. 

b. A SOC 2 engagement is based on criteria from COSO’s internal control framework. 

c. A SOC 2 engagement is based on Trust Services Criteria of Security, Availability, Processing Integrity, Confidentiality, and Privacy. 

d. The users of a SOC 2 report are not expected to understand the details of the IT system being reported on or the nature and limitations of a SOC 2 engagement.