SOC 3 trades detail for an audience anyone can join.

A SOC 2 report is long and private. A SOC 3 report gives the same kind of opinion in a few pages that you can post publicly. It tells readers the result, but not the controls and tests behind it.

Spelled out: System and Organization Controls 3, a general-use report on controls relevant to the Trust Services Criteria.

Many readers do not need, and should not get, the full SOC 2. A prospect browsing your website, a small customer without an NDA, or a partner doing a first check only wants to know that an independent auditor examined your controls. A SOC 3 serves them. It is commonly issued together with a SOC 2 from the same examination. Because it leaves out control descriptions and test results, a serious security reviewer will still ask for the SOC 2. Knowing the difference stops sales teams from offering the wrong report, or publishing one that was never meant to be public.

A company's trust or security page

The SOC 3 is posted as a download that needs no NDA.

Early sales conversations

Shared with prospects who need a quick assurance signal before the NDA stage.

The engagement letter with the CPA firm

Lists the SOC 3 as an additional deliverable alongside the SOC 2.

Marketing review

Wording on the website about the report is checked so it matches what the SOC 3 says.

SOC 2

Same criteria and often the same examination, but the SOC 2 carries the description, controls and tests, and is restricted in use.

SOC 3 seal

A logo some companies display. The seal is separate from the report, and the report is what carries the opinion.

• Ask your CPA firm whether a SOC 3 can be issued alongside your SOC 2.
• Publish the full SOC 3 rather than quoting selected lines from it.
• Keep website wording accurate: name the period and say it is a report, not a certificate.
• Point detailed questions to the SOC 2 under NDA.

• GuideSOC 3, explainedThe public report: what it holds and what it leaves out.
• GuideSOC 3 vs SOC 2Same criteria, different readers, and when each fits.
• GuidePublishing a SOC 3 reportPutting it on your site, and wording that stays accurate.

Sources: AICPA SSAE 18, AT-C section 205; AICPA guide on SOC 2 examinations and SOC 3 reporting; AICPA TSP section 100, 2017 Trust Services Criteria; AICPA SOC suite pages.