Because it leaves out the detail that makes a SOC 2 sensitive, a SOC 3 can be published, for example on a trust page. It comes out of the same examination as the SOC 2.
It does not replace the SOC 2 in a security review, because a reviewer cannot see which controls were tested or whether any exceptions were found.
Read more
Related terms
- SOC 2
- SOC 2 is an attestation report in which a CPA firm gives an opinion on a service organization's controls against the AICPA Trust Services Criteria.
- SOC 1
- SOC 1 is a CPA firm's report on a service organization's controls that are relevant to its customers' internal control over financial reporting.