SOC 1, SOC 2 and SOC 3 are all reports a CPA firm issues on a service organization's controls. They differ in what the controls are for and in who may read the report. A SOC 1 report covers controls relevant to your customers' internal control over financial reporting and is read mainly by their financial auditors. A SOC 2 report covers security, and optionally availability, processing integrity, confidentiality and privacy, against the AICPA Trust Services Criteria; it is the report security and procurement teams ask for, and it is shared under NDA. A SOC 3 report is a general-use version of a SOC 2 with the auditor's opinion and a short system description but none of the detailed tests, so you can publish it.
Buyers often ask for "a SOC report" without saying which one, and vendors sometimes offer the wrong one. The three reports share a family name and a CPA firm as the issuer, but they answer different questions for different readers. Getting the choice right before you engage an auditor avoids paying for an examination nobody asked for.
The three reports side by side
| Question | SOC 1 | SOC 2 | SOC 3 |
|---|---|---|---|
| What it covers | Controls relevant to customers' internal control over financial reporting | Controls against the Trust Services Criteria: Security, plus Availability, Processing Integrity, Confidentiality and Privacy where in scope | The same examination as a SOC 2 |
| Who sets the bar | The service organization defines its own control objectives | The AICPA Trust Services Criteria | The AICPA Trust Services Criteria |
| Typical reader | Customers' finance teams and their external auditors | Customers' security, risk and procurement teams | Anyone, including prospects and the public |
| Distribution | Restricted to customers and their auditors | Restricted to readers with enough knowledge to understand it, usually under NDA | General use; can be published |
| Report types | Type 1 or Type 2 | Type 1 or Type 2 | Usually issued with a Type 2, covering the same period |
| Detail on controls and tests | Full description of controls, the auditor's tests and results | Full description of controls, the auditor's tests and results | Opinion, management's assertion and a short system description, with no test detail |
When you need a SOC 1
You need a SOC 1 when your service can affect the numbers in your customers' financial statements. Payroll, billing and invoicing, payment processing, claims processing, fund administration and similar services fall here. Your customers' auditors need to understand and rely on your controls to sign off on their client's financial statements, and a SOC 1 is how they do it without auditing you themselves.
The request usually comes from a customer's finance team or controller, or from their external auditor, and it often mentions internal control over financial reporting, SOX or ISAE 3402. Unlike SOC 2, a SOC 1 has no fixed criteria. Management writes the control objectives, such as "payroll changes are authorized and processed completely and accurately", and the auditor tests the controls that support them.
When you need a SOC 2
Most SaaS, cloud and IT service providers need a SOC 2, because their customers' question is whether their data and the service are secure, not whether their ledgers are right. The request comes from security questionnaires, vendor risk reviews and procurement, and it is the default ask from US enterprise buyers.
Security, made up of the common criteria, is in scope in every SOC 2. The other four categories are added when your commitments make them relevant; the guide to the Trust Services Criteria covers how to choose them, and the Type I versus Type II comparison covers which report type to start with.
What a SOC 3 is for
A SOC 3 is a short, general-use report on the same SOC 2 examination. It carries the auditor's opinion, management's assertion and a brief description of the system, and leaves out the detailed controls, tests and results that make a SOC 2 sensitive. Because it is not restricted, you can publish it on a trust page or hand it to prospects before an NDA is in place.
It is not a substitute for the SOC 2 in a security review. A reviewer wants to see which controls were tested and whether there were exceptions, and a SOC 3 does not say. Treat it as the public signal, and keep the SOC 2 for the people who need the detail. It is produced from the same fieldwork, so the additional work is mostly the auditor writing a second report.
Can you need both SOC 1 and SOC 2?
Yes. A payroll or billing platform is a common example: the customer's auditors want a SOC 1 for the financial-reporting controls, and the customer's security team wants a SOC 2 for the platform. They are separate examinations with separate reports, but auditors often run them together, and controls that both rely on, such as access management and change management, can be tested once and used in both.
Where ISAE 3402 and ISAE 3000 fit
Outside the US, the international standards set by the IAASB play the same roles. ISAE 3402 is the standard for assurance reports on controls at a service organization that are relevant to customers' financial reporting, the counterpart of SOC 1, and many firms issue a combined SOC 1 and ISAE 3402 report. For security, assurance reports are often issued under ISAE 3000, sometimes against the Trust Services Criteria, while ISO 27001 certification is the more common expectation in Europe.
Only a licensed CPA firm can issue a report under the AICPA's SOC 2 name. If a European customer asks for "a SOC 2", it is worth confirming whether they need that report specifically or would accept an ISO 27001 certificate or an ISAE 3000 report; the ISO 27001 and SOC 2 comparison covers the difference.
Which one to ask for, or offer
- Your service touches customers' financial reporting: offer a SOC 1, or an ISAE 3402 report for customers outside the US.
- Customers ask about the security of their data and the service: offer a SOC 2, and choose Type 1 or Type 2 by what they will accept.
- You want something you can publish: add a SOC 3 to the SOC 2 examination.
- You are buying a service: ask for the report that matches your risk, a SOC 1 if it feeds your financial statements and a SOC 2 if it holds your data.