SOC 3
SOC 2 and SOC 3: one set of criteria, two kinds of reader.
The two reports measure controls against the same Trust Services Criteria. A SOC 2 is built for a reviewer who will study the tests. A SOC 3 is built for anyone, so it states the conclusion and stops. Choosing between them is mostly a question about who will read and how you sell.
Back to SOC 2 services01 · Side by side
The two reports compared
Same yardstick; different audience, distribution and depth.
| Dimension | SOC 2 | SOC 3 |
|---|---|---|
| Audience | Informed parties: customers' security, risk and audit teams | Anyone, including people you have never met |
| Distribution | Restricted use, usually shared under NDA | General use, may be freely distributed |
| Criteria | Trust Services Criteria, plus DC 200 for the description | Trust Services Criteria |
| Description of the system | Detailed, control by control | Brief: boundaries and principal commitments |
| Tests and results | Included in a Type 2 | Not included |
| Exceptions | Listed with management's responses | Not listed individually |
| Use in sales | Late-stage due diligence and vendor reviews | Early-stage reassurance, trust pages, tenders |
SOC 1 sits outside this comparison: it is about customers' financial reporting, not the Trust Services Criteria. The three-way view is on our SOC family guide.
02 · How they relate
Usually one examination, two reports
A SOC 3 is commonly issued from the same work as a SOC 2 Type 2.
Most companies that hold a SOC 3 get it from the same engagement as their SOC 2 Type 2. The CPA firm examines the controls once and then issues two reports with different levels of detail. Agree this in the engagement letter at the start, so the firm plans for both and the SOC 3 names the same period and categories.
03 · One or both
When you need one, the other, or both
Three patterns cover most companies.
- SOC 2 onlyBuyers are few and large, every deal runs a vendor review, and sharing under NDA is routine. A public report would add little.
- SOC 3 onlyRare. Suits a company whose customers want only public evidence and never ask for test detail. Most enterprise buyers will still ask for a SOC 2.
- BothMany prospects, a self-serve or partner channel, a public trust page, and enterprise customers who still want the detail later.
A SOC 3 does not replace a SOC 2 request
If a customer's security team asks for your SOC 2, sending the SOC 3 answers a different question. Offer it as a first look, then share the SOC 2 under its usual terms.
04 · Decision path
A decision path
Five questions, in order.
- Do customers or prospects ask for a SOC report at all? If not, neither may be the right first step.
- Do they ask for test detail, or will they sign an NDA to see it? If yes, you need a SOC 2.
- Do many prospects drop off before an NDA is in place? If yes, a SOC 3 gives them something to read first.
- Do you want a public trust page that names an independent examination? If yes, add a SOC 3.
- Can your CPA firm issue both from one examination? Ask before you sign the engagement letter.
| Illustrative company | Pattern | Why |
|---|---|---|
| A data platform selling to a few large banks | SOC 2 only | Each bank reviews the full report under NDA |
| A self-serve SaaS tool with thousands of small customers | Both | Small buyers read the SOC 3; larger ones request the SOC 2 |
| A hosting firm listed in partner marketplaces | Both | Marketplaces and tenders want a public document |
Sources: AICPA SOC 3 topic page and illustrative SOC 3 report; AICPA SOC 2 guide (reporting on an examination of controls at a service organization relevant to security, availability, processing integrity, confidentiality or privacy); AICPA SSAE No. 18, AT-C sections 105 and 205, as amended; AICPA TSP section 100 and DC section 200. Companies are illustrative.
Questions about SOC 3 and SOC 2
Does a SOC 3 cost a second examination?
Usually not a second examination.
It is commonly issued from the same work as the SOC 2 Type 2. The CPA firm sets its own fees for the extra report; ask when you agree the engagement.
Can we get a SOC 3 without a SOC 2?
Possible, but uncommon.
A CPA firm can examine and report for general use only. Most companies want the SOC 2 as well, because serious buyers still ask for the detail.
Do the two reports cover the same categories?
They should, when issued together.
When both come from one examination, the categories and period normally match. Check the SOC 3 states them, so readers are not misled about scope.
Which report should we put on our website?
Only the SOC 3.
The SOC 2 is restricted use. The SOC 3 is the report designed for public distribution.
Plan both reports at the start, not after.
We help you decide whether a SOC 3 belongs in your plan and prepare the SOC 2 examination it comes from.