From SSAE 16 to SAS 70 (Part II): SOC reporting and certification