Governance and Policy ManagementSOC 1 vs SOC 2 vs SOC 3: Which Report Do You Need?
SOC 1, SOC 2 and SOC 3 sound like three stages of the same compliance journey.
They are not.
A company does not complete SOC 1 and then “move up” to SOC 2. SOC 3 is not a more advanced version of SOC 2 either.
They are different AICPA System and Organization Controls reports, designed for different audiences and assurance needs.
The easiest way to choose between them is to start with the question your customer is trying to answer.
Could your service affect their financial statements? SOC 1 may be relevant.
Do they need detailed assurance over security or related controls? That points toward SOC 2.
Do you need a public report that provides assurance without exposing detailed testing information? SOC 3 may fit.
SOC 1, SOC 2, and SOC 3 are three reports from the AICPA’s service organization suite, and each answers a different question for a different reader. Complyan’s SOC 2 compliance guide covers the framework in depth. This piece compares all three, and shows how to match the report to whoever is asking. The first step matters: soc2auditors.org points out that a request for an “SSAE 18 report” does not say which report the customer wants.
The Three Reports at a Glance
SOC 1 | SOC 2 | SOC 3 | |
Subject | Controls relevant to customers’ financial reporting | Controls against the Trust Services Criteria | The same criteria as SOC 2, in summary |
Standard | SSAE 18, AT-C section 320 | AT-C sections 105 and 205 | Same criteria basis as SOC 2 |
Typical readers | Customers and their financial statement auditors | Customers’ security, risk, and vendor teams | Anyone |
Distribution | Restricted | Restricted, usually under NDA | General use, can be posted publicly |
The table follows descriptions from BD Emerson, SmartSuite, and ComplyJet, which summarize the AICPA’s SOC 2 guidance.
SOC 1: Controls That Touch Your Customers' Financial Statements
A SOC 1 report covers controls at a service organization that could affect its customers’ financial reporting. PYA notes organizations typically use it when controls could affect financial reporting or financial statement audits, and RSI Security adds that financial services organizations usually require it. Illustrative examples include a payroll, billing, or payment processing provider, because errors in those services flow straight into a customer’s numbers.
Management writes the control objectives, per BD Emerson, and soc2auditors.org notes the AICPA names user entities and their financial statement auditors as the intended readers. No general-use version exists, so a SOC 1 has no public counterpart.
Customers outside the United States may ask for ISAE 3402 instead. Wikipedia’s entry on the standard describes an ISAE 3402 engagement as a SOC 1 engagement.
SOC 2: Controls Customers' Security Teams Read
A SOC 2 report evaluates controls against the AICPA Trust Services Criteria. Security is always in scope, and BD Emerson notes the auditor tests it against 33 common criteria in the 2017 criteria, with points of focus revised in 2022. Availability, processing integrity, confidentiality, and privacy are added when the service makes promises in those areas.
Type I: covers the design of controls as of a single date, per SmartSuite. It suits a first report or a deal that cannot wait.
Type II: covers design and operating effectiveness over a period, and lists the tests and results. Wikipedia’s ISAE 3402 entry puts the period at 3 to 12 months. Enterprise buyers often treat it as the stronger assurance.
SOC 2 is not a public document. ComplyJet stresses it is just as restricted as SOC 1, so customers receive it under agreement.
What Is Inside a SOC 2 Type II Report
SmartSuite notes a Type II report lists the tests performed and their results. In practice, readers will find management’s description of the system, the auditor’s opinion, the controls tested, and any exceptions the auditor found. The exceptions section shows where a control did not operate as described.
SOC 3: The Public Summary
A SOC 3 report addresses the same criteria as a SOC 2 without the detailed description and test results. The AICPA classifies it as a general-use report that can be freely distributed, as BD Emerson and soc2auditors.org explain, so companies often post it on a trust page.
It is not a stronger or weaker report. soc2auditors.org says SOC 3 is the general-use version of the same subject matter, with less detail. ComplyJet describes it as always built from an existing SOC 2 Type II report, with no Type I version of its own. Security teams reviewing a vendor will still ask for the SOC 2, because only that report shows what was tested.
Match the Report to the Reader
Who is asking | What they need | Report |
A customer’s auditor testing financial reporting controls | Evidence on controls that feed their numbers | SOC 1 |
An enterprise security or vendor risk team | Detailed control testing against recognized criteria | SOC 2, Type II where possible |
A prospect browsing your website | A public signal of independent testing | SOC 3, after a SOC 2 |
Both financial and security buyers | Two different assurances | SOC 1 and SOC 2 |
A request that only says “SOC report” | Unknown | Ask which readers and which risks |
SOC 1 and SOC 2 Can Both Have Type I and Type II Reports
Another common source of confusion is the difference between the SOC number and the report type.
SOC 1 and SOC 2 can each be issued as Type I or Type II reports.
A Type I report evaluates the design of controls at a specified point in time.
A Type II report goes further by evaluating whether those controls operated effectively over a defined period.
This distinction matters commercially.
A growing SaaS company may initially pursue SOC 2 Type I to establish that its controls have been designed and implemented. Customers with stronger assurance requirements may then expect SOC 2 Type II because it provides evidence that those controls operated over time.
Complyan has previously covered this decision in detail in SOC 2 Type I and Type II: Which Report Does Your Business Need First?.
Common Mistakes
Choosing by name instead of by reader: the right report is the one the person asking can use.
Posting a SOC 2 publicly: that report is meant for specified parties, and the public version is SOC 3.
Expecting a SOC 3 to satisfy a security review: it lacks the test detail reviewers need.
Starting evidence collection when the period begins: a Type II period tests operation throughout, so records must exist from day one.
Frequently Asked Questions About Vendor Risk Scoring
Is SOC 2 better than SOC 1?
No. They address different risks. SOC 1 focuses on controls relevant to financial reporting, while SOC 2 focuses on security and other Trust Services Criteria.
Is SOC 3 a higher level than SOC 2?
No. SOC 3 is a general-use report with less detailed information than SOC 2.
Can a company need SOC 1 and SOC 2?
Yes. A service provider that affects customer financial reporting while also hosting sensitive information may have valid reasons to pursue both.
What is the difference between SOC 2 Type I and Type II?
Type I examines control design at a specific date. Type II also evaluates operating effectiveness over a defined period.