SOC 3

What is SOC 3?

A SOC 3 report is an independent auditor’s report on a service organisation’s controls against the AICPA’s Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. These are the same criteria a SOC 2 report uses. The difference is detail. A SOC 3 says whether the controls met the criteria, but leaves out the detailed description of the system and of the auditor’s tests and results that a SOC 2 contains.

Because of that, the AICPA treats it as a general-use report that can be freely distributed. Providers often publish it on their website or trust page, where anyone can download it without signing a non-disclosure agreement.

Who is it for?

It is for anyone who wants a quick, public signal that a provider’s controls have been independently examined: prospective customers, partners and the public. It is useful early in a sales conversation, before a customer is ready to sign an NDA for the full SOC 2.

What can’t it tell you?

A SOC 3 doesn’t list the controls, the tests the auditor ran or any exceptions found. A customer that relies on a provider for something important, or whose own auditors need detail, should ask for the SOC 2 Type 2 report instead. Check which criteria the report covers and the period it relates to: a report that covers only security tells you nothing about availability or privacy.

How does it relate to other frameworks?

A provider usually produces its SOC 3 alongside a SOC 2 from the same examination of the same controls. SOC 1 is different again: it covers controls relevant to customers’ financial reporting and is meant for customers and their auditors only. Customers comparing providers internationally may also see ISO/IEC 27001 certificates, which are public too, but certify a management system rather than report on controls over a period.