SOC 3 Reports: The General-Use Trust Services Report and How It Differs From SOC 2

A SOC 3 report is a general-use report from an examination of a service organization's controls against the AICPA's Trust Services Criteria. It comes from the same kind of engagement as a SOC 2 and rests on the same evidence. What differs is the report: a SOC 3 leaves out the detailed description of the system and the practitioner's tests and results, so the organization can post it on a website or hand it to prospects without a nondisclosure agreement.

This page explains the standard for CPA firms and for finance and security teams deciding between SOC 2 and SOC 3. It paraphrases the AICPA's attestation standards; read AT-C 105 and AT-C 205 and the AICPA's SOC 2 guide for the full text.

Where does SOC 3 fit among the SOC reports?

SOC reports are attestation engagements performed under the AICPA's attestation standards, the AT-C sections introduced by SSAE 18. See the SSAE 18 overview.

A SOC 3 is an examination, so the practitioner expresses a positive opinion based on reasonable assurance. It is not a lighter engagement than a SOC 2. The work to support the opinion is the same, and the savings, if any, are in report preparation and in not describing the tests in the report.

What does a SOC 3 report contain?

The AICPA's illustrative SOC 3 report has three parts:

1. The practitioner's report. It states the opinion on whether the controls within the system were effective to provide reasonable assurance that the service organization's service commitments and system requirements were achieved based on the applicable trust services criteria. It names the criteria used and the period covered.
2. Management's assertion. Management asserts that the controls were effective on the same basis. The practitioner cannot report on an assertion management has not made.
3. Attachments on the system. The illustrative report attaches a description of the boundaries of the system and the principal service commitments and system requirements. These are brief compared with the full description in a SOC 2.

It does not include the description of the system in the form that description criteria require for a SOC 2, the controls that were tested, or the results of tests, including any exceptions found. A reader of a SOC 3 learns the opinion and the scope, and learns nothing about exceptions unless they affect the opinion.

What are the Trust Services Criteria?

The criteria are the AICPA's TSP section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (with revised points of focus, 2022). Security is the one category every examination includes. The others are added based on the commitments the organization makes to customers. The report names the categories in scope, and a reader should check that the categories match what the organization promises.

What changes for the practitioner?

A SOC 3 adds a few decisions to the SOC 2 workflow:

• The opinion goes public. If the SOC 2 examination produces a qualified or adverse opinion, a SOC 3 from that examination carries the same opinion. The client's marketing team should know that before commissioning one.
• Scope has to be accurate in two forms. The system boundaries in the SOC 3 attachment must match the full description in the SOC 2. Inconsistencies read as a problem on either side.
• Subservice organizations need a view. If the service organization relies on a subservice organization, for example a cloud host, the report treats it by the carve-out or inclusive method, and the SOC 3 attachment says which. See subservice organization.
• Use restrictions differ. A SOC 2 is restricted-use; a SOC 3 is not. Engagement letters need to state who may receive the report.
• The seal program is gone. The AICPA discontinued its SOC 3 seal program in 2014, and organizations marketing a SOC 3 use the AICPA SOC logo under its usage terms.

Independence is required for examinations. The same nonattest services evaluation applies if the firm also helps the client with readiness work.

SOC 2 or SOC 3: how to choose

Illustrative scenario: a payments software company has a Type 2 SOC 2 and gets two kinds of requests. Enterprise customers' procurement teams ask for the SOC 2 under NDA because their own vendor-risk staff need the tests and results. Small customers and prospects ask on the website for evidence of a security audit and do not read test tables. The SOC 2 serves the first group. A SOC 3 posted on the site serves the second. A SOC 3 cannot replace the SOC 2 for the first group, because it does not show what was tested or what was found.

Frequently asked questions

Is a SOC 3 report the same as a SOC 2?

No. Both come from an examination against the Trust Services Criteria, but a SOC 2 is a restricted-use report with the system description, tests of controls and results, and a SOC 3 is a general-use report without them.

Can a company share a SOC 3 publicly?

Yes. That is its purpose. A SOC 3 is general use and does not require a nondisclosure agreement, though the organization decides who receives it.

Is a SOC 3 easier to get than a SOC 2?

Not materially. The examination that supports it is the same. A SOC 3 report is shorter and does not describe the tests.

Does SOC 3 have a Type 1 and Type 2?

The SOC 2 and SOC 3 reports can cover a point in time or a period. Most are period reports, which parallel a Type 2 report.

Sources

• AICPA, SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy (guide), and AICPA illustrative SOC 3 report
• AICPA, TSP section 100, 2017 Trust Services Criteria (With Revised Points of Focus, 2022)
• AICPA Professional Standards, AT-C 105 and AT-C 205
• AICPA Assurance Services, SOC suite of services: aicpa-cima.com

Related

• SOC 2 report glossary
• SOC examination
• SSAE 18 overview
• SOC 2 control matrix template
• SOC 2 readiness checklist
• Service organizations and SOC 1 under AU-C 402

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error