A SaaS provider that hosts financial reporting applications for multiple publicly traded clients is asked by an enterprise customer to demonstrate that its internal controls over security, availability, and confidentiality have been independently audited over a period of time. Which compliance report is specifically designed to satisfy this request?