The SOC family
Pick the SOC report by asking who will read it and what they could lose.
Three AICPA reports carry the SOC name, and the numbers mark neither levels nor editions. Each was built for a different reader with a different worry. A client's auditor worries about misstated figures, a security reviewer about exposed data, and a stranger on your website about whether anyone independent has looked at all. Identify the reader and the right report follows.
Back to SOC 2 services01 · Read the request
Three people who might be asking
The wording of a request often names the wrong report. The reader behind it seldom misleads.
- A client's external auditor
- Audits the client's accounts and needs comfort over work of yours that flows into them, such as computing salaries or posting loan repayments. This reader wants a SOC 1.
- A client's security or vendor-risk reviewer
- Decides whether your service can be trusted with the company's information. This reader wants a SOC 2, and usually the Type 2.
- Anyone on the open web
- A prospect, partner or journalist with no NDA in place. The restricted reports cannot go to this reader, which is why a SOC 3 exists.
Procurement teams sometimes write "your SOC report", or even "SOC 1", on a security questionnaire purely out of habit. Before you scope anything, find out who in the client company will open the report and what decision it feeds.
02 · At a glance
How the three line up
Read across a row to see where the reports differ, or down a column to see one report whole.
| Question | SOC 1 | SOC 2 | SOC 3 |
|---|---|---|---|
| What could go wrong for the reader? | Their financial statements could be misstated | Their information could be exposed, lost or unreachable | As for SOC 2, at summary level |
| What is the yardstick? | Control objectives that management writes for its own service | The AICPA Trust Services Criteria | The Trust Services Criteria |
| Which attestation sections govern it? | AT-C 320, resting on AT-C 105 and 205 | AT-C 105 and 205, applied through the AICPA SOC 2 guide | AT-C 105 and 205 |
| Are the tests and results printed? | Yes, in a Type 2 | Yes, in a Type 2 | No: opinion, assertion and a short system summary |
| Who may receive it? | Management, client companies and their auditors | Readers with enough background to understand it, usually under NDA | Anyone, as a general-use report |
03 · Date or period
The second choice: one date or a stretch of months
Type 1 and Type 2 form a separate dial, and it applies to SOC 1 and SOC 2 alike.
A Type 1 opinion covers whether controls were suitably designed and in place on a single date. A Type 2 adds whether they operated effectively over a period, and it sets out each test the CPA firm ran and what turned up. Client auditors relying on a SOC 1 and reviewers reading a SOC 2 both lean toward Type 2, since a design never shown to run tells them little.
A SOC 3 carries no Type label in practice. It is normally issued from the same period-of-time examination that produces a SOC 2 Type 2.
04 · When you need two
Illustrative cases: one company, more than one report
Some services touch both a client's books and its information. Four made-up examples show the pattern.
- Illustrative: a payroll bureauIts pay runs feed every client's salary expense, so client auditors want a SOC 1. Its database holds bank details and tax IDs, so HR buyers want a SOC 2. Aligned periods can let one round of fieldwork serve both, if the CPA firm agrees.
- Illustrative: a log-search startupNo client's accounts depend on it, yet it stores their system logs. A SOC 2 alone fits; a SOC 1 would have almost nothing to examine.
- Illustrative: a claims processor for insurersIts payments land in insurers' ledgers and its files hold medical details. Both reports, with Processing Integrity a likely addition to the SOC 2.
- Illustrative: any of these with a public trust pageOnce the SOC 2 Type 2 is issued, a SOC 3 can go on the website for readers who will never sign an NDA.
05 · Other SOC names
Two more reports in the suite, and where to read next
The AICPA has stretched the SOC brand past the three service-organization reports.
SOC for Cybersecurity reports on an entity's whole cybersecurity risk management program, not on a service delivered to clients. SOC for Supply Chain looks at controls over producing, manufacturing or distributing goods. Buyers of software or outsourced services seldom ask for either.
- SOC 1 or SOC 2: which do you need?A decision path for service providers asked for either.
- SOC 3, explainedThe public report: what it holds and what it leaves out.
- Who needs a SOC 1 report?A test for service providers whose work touches clients' financial statements.
Sources: AICPA, SOC suite of services pages (SOC 1, SOC 2, SOC 3, SOC for Cybersecurity, SOC for Supply Chain); AICPA, SSAE 18, AT-C sections 105, 205 and 320; AICPA, 2017 Trust Services Criteria; AICPA, DC 200 description criteria.
06 · Go deeper
Go deeper
Dedicated pages on topics this guide only touches.
Choosing among the SOC reports
Is a SOC 2 a newer edition of SOC 1?
No. The numbers are names, not editions.
SOC 1 and SOC 2 were built for different readers and exist side by side. A company may hold either, both or neither, and holding one says nothing about the other.
A client wrote SOC 1 on a security questionnaire. What do we send?
Ask what they plan to do with it.
If the reader is the client's financial auditor, a SOC 1 is right. If the questions are about access, encryption and incidents, the reader almost certainly means a SOC 2. A short call usually settles it.
Can a SOC 3 stand in for a SOC 2 in a security review?
Seldom, because it leaves out the testing detail.
A SOC 3 holds the opinion and a summary but not the tests and results. Most reviewers treat it as a first signal and then ask for the SOC 2 under NDA.
Who issues these reports?
A licensed CPA firm, never the company itself.
Each one is an examination by an independent CPA firm under AICPA attestation standards. Advisers can get you ready; only the firm signs the opinion.
Unsure which report your clients mean?
We read the requests and contracts in front of you and set out which SOC report, and which type, each reader needs.