SOC 3
A SOC 3 is short on purpose. Read it for what it is.
The AICPA describes a SOC 3 as a report on controls relevant to the Trust Services Criteria that is meant for general use and may be freely distributed. It reaches the same kind of conclusion a SOC 2 does, but it keeps out the detail that makes a SOC 2 useful to a security reviewer. This page explains what is inside, who it is for, and where its limits lie.
Back to SOC 2 services01 · What is inside
Three parts, a few pages long
An opinion, an assertion, and a short description of the system.
- The independent service auditor's report
- The CPA firm's opinion on whether controls were effective to meet the service commitments and system requirements based on the chosen Trust Services Criteria.
- Management's assertion
- The company's signed claim about its controls over the period, which the opinion addresses.
- A description of the system
- A brief account of the system boundaries and the principal commitments the company makes to its customers. Far shorter than a SOC 2 description.
The engine underneath is the same one used for a SOC 2: an examination under the AICPA's attestation standards, AT-C 105 and 205, measured against the Trust Services Criteria (TSP section 100). What changes is the reader, and so the amount of detail.
02 · Who can read it
Anyone can read it
General use means no restriction on who receives it.
A SOC 2 is written for informed parties who understand the system, so its use is restricted. A SOC 3 has no such restriction. The AICPA states that SOC 3 reports are general-use reports that can be freely distributed. That is what makes it suitable for a website, a sales deck or a tender response sent to people you have never met.
- Prospects early in a dealA quick signal before an NDA is signed.
- Procurement teamsA document to file that names the criteria, the period and the firm.
- Partners and the publicEvidence that an independent CPA firm examined controls.
- Security reviewersUseful context, but rarely enough on its own for a deep review.
03 · What it leaves out
What a SOC 3 deliberately leaves out
No tests, no results, no detailed control list.
In a SOC 3
- The opinion and the criteria used
- The period covered
- Management's assertion
- A short system description
Not in a SOC 3
- The CPA firm's tests of controls and their results
- Individual exceptions found in testing
- The full control-by-control description
- The detailed lists of complementary user entity controls a SOC 2 sets out
If a reader needs to see how a control was tested or what deviations were found, the SOC 2 is the document to request.
04 · What not to infer
What a reader should not infer from a SOC 3
A clean opinion is a statement about controls in a period, not a promise.
- “They have never had an incident.”. The report concerns whether controls met the criteria. It does not list incidents for a public reader.
- “Every product is covered.”. Only the system named in the description is in scope. Check the boundary.
- “It is current.”. It covers a stated period. Months after that period ends, it says nothing about today.
- “Testing found nothing.”. Exceptions can exist even under an unmodified opinion. A SOC 3 simply does not show them.
- “All five categories were examined.”. Many reports cover Security only. The report names which categories were included.
05 · A reading example
Illustrative: a buyer reads a SOC 3 in five minutes
What a careful reader checks and what they ask for next.
- Find the CPA firm's name and confirm it is a licensed firm, not a consultancy.
- Read the period and note how long ago it ended.
- Check which Trust Services categories were included.
- Read the system boundary and confirm it covers the product being bought.
- Read the opinion paragraph for any qualification.
- If the purchase carries real risk, request the SOC 2 under NDA.
Sources: AICPA SOC 3 topic page (SOC for Service Organizations: Trust Services Criteria for General Use Report) and its illustrative SOC 3 report; AICPA SSAE No. 18, AT-C sections 105 and 205, as amended; AICPA TSP section 100, 2017 Trust Services Criteria with revised points of focus. The reading example is illustrative.
Questions about SOC 3
Is a SOC 3 a lighter audit than a SOC 2?
No. The examination is comparable; the report is shorter.
The CPA firm still examines controls against the Trust Services Criteria. The difference lies in what the report shows: the opinion and a summary, without the tests and results.
Who issues a SOC 3?
A licensed CPA firm.
Only a licensed CPA firm independent of the company can perform the examination and issue the report. Advisers such as Auditify help prepare for it; they do not issue it.
Is there a Type 1 SOC 3?
In practice, a SOC 3 covers a period.
SOC 3 reports address whether controls were effective throughout a period, which is why they are usually produced alongside a SOC 2 Type 2. Confirm the approach with your CPA firm.
Can a SOC 3 show exceptions?
Not in the detail a SOC 2 does.
Individual test exceptions are not set out. A modified opinion, if there is one, would appear in the opinion itself, which is why it is worth reading in full.
Decide whether a public report fits your sales motion.
We help you scope the SOC 2 examination a SOC 3 is built from, and plan how each report will be shared.