CyphrQ
Menu

SOC 1 vs SOC 2 vs SOC 3: Which Report You Need and What to Check

SOC 1 covers financial reporting controls, SOC 2 security and trust criteria, SOC 3 is the public summary. Plus Type 1 vs 2 and what to check.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

11 min read

SOC 1 vs SOC 2 vs SOC 3 comes down to subject and audience. SOC 1 covers a supplier's controls that affect your financial reporting. SOC 2 covers security, availability, processing integrity, confidentiality and privacy. SOC 3 is a short public version of SOC 2. Independent CPAs write all three under AICPA standards. For security due diligence on a cloud or SaaS supplier, a SOC 2 Type 2 is usually the one to request.

"SOC" here stands for System and Organization Controls. The AICPA describes it as "a suite of service offerings CPAs may provide" on the controls of a service organisation. The reports exist so that companies outsourcing work can judge the risk without auditing the provider themselves.

Choosing between SOC 2 and ISO/IEC 27001 for your own company is covered in SOC 2 vs ISO 27001. This post covers the SOC family and how to read a supplier's report.

What is the difference between SOC 1, SOC 2 and SOC 3?

SOC 1 SOC 2 SOC 3
Question it answers Do the supplier's controls support my financial statements? Do the supplier's controls meet the Trust Services Criteria I care about? The same as SOC 2, in summary form
Main readers Customers ("user entities") and their financial auditors Customers' security, risk and procurement teams Anyone
Yardstick Control objectives relevant to financial reporting 2017 Trust Services Criteria 2017 Trust Services Criteria
Attestation standard AT-C section 320 AT-C sections 105 and 205 Often issued from the same examination as a SOC 2
Distribution Shared with customers and their auditors Usually behind a login or agreement Can be freely distributed

The rows come from the AICPA pages for SOC 1 and SOC 3, and from Microsoft's compliance pages for SOC 1 and SOC 2, which list the standards each examination is performed under. The "Distribution" row for SOC 1 and SOC 2 describes common practice, not an AICPA rule.

What does a SOC 1 report cover?

SOC 1 is about the numbers. The AICPA's guide describes it as reporting on a service organisation's controls "when those controls are likely to be relevant to user entities' internal control over financial reporting" (AICPA SOC 1 guide). Its intended readers are the customers and the auditors of their financial statements.

Microsoft's SOC 1 page gives a concrete use: customers can draw on its Microsoft 365 SOC 1 Type 2 report for requirements such as Sarbanes-Oxley (SOX), FFIEC and GLBA (Microsoft Learn). When your finance team or external auditor asks for a supplier's "SOC report", that is usually what they mean.

Don't use a SOC 1 as your security review. Its scope is set by what matters to financial reporting, not by your security questions.

What does a SOC 2 report cover?

A SOC 2 reports on controls relevant to security, availability, processing integrity, confidentiality or privacy, measured against the AICPA's 2017 Trust Services Criteria (TSP section 100). The provider chooses which of those categories are in scope, so "we have a SOC 2" tells you less than it sounds.

In practice: Azure. Microsoft describes its Azure SOC 2 Type 2 reports as relevant to "system security, availability, processing integrity, and confidentiality" (Microsoft Learn, Azure SOC 2). Privacy is not on that list. That doesn't make Azure weak on privacy. It means the SOC 2 is not where you would look for assurance on it.

SOC 2 reports are rarely public. Microsoft, for example, requires an existing subscription or a free trial account to download its SOC 1 and SOC 2 reports (Microsoft Learn). Expect to sign in to a trust portal or agree to terms before a supplier sends one.

What is a SOC 3 report, and who is it for?

The AICPA says SOC 3 reports address the same five areas as SOC 2 but "do not provide the same level of detail", and that they "are considered general use reports and can be freely distributed" (AICPA SOC 3).

So a SOC 3 is the version a provider can post on its website. Microsoft issues its Microsoft 365 SOC 3 "based on the SOC 2 examination" and at the same time (Microsoft Learn).

A SOC 3 is a reasonable first filter when you shortlist suppliers. It isn't enough for a supplier that will hold sensitive data, because it leaves out the detail you need to judge the controls yourself.

Should you ask for a Type 1 or a Type 2 report?

Both SOC 1 and SOC 2 come in two types.

  • Type 1 looks at whether controls are suitably designed and in place on one date. In Microsoft's words, "Type 1 audits don't look back over a period of performance" (Microsoft Learn).
  • Type 2 adds testing over a stretch of time. Microsoft's Azure page says a SOC 2 Type 2 evaluates whether controls "are designed appropriately, were in operation on a specified date, and were operating effectively over a specified time period" (Microsoft Learn).

Ask for Type 2. A Type 1 is acceptable for a brand-new service or a supplier in its first audit year, as long as a Type 2 is on the way. Even Microsoft uses Type 1 this way: it commissions a mid-year Type 1 examination for new Microsoft 365 services that have launched since the last Type 2.

Who issues SOC reports?

A CPA firm, under professional standards the AICPA sets. The supplier's management writes the description of its system, and the auditor gives an opinion on that description and on the controls.

The AICPA also warns that "SOC services should be thoroughly evaluated by service organizations and CPA firms", and links ethics staff guidance on SOC tool providers from its SOC landing page. Compliance software can help a supplier gather evidence. The opinion itself still has to come from a CPA firm, so check which firm signed it.

What is SOC for Cybersecurity?

SOC for Cybersecurity is a different engagement with a wider lens. The AICPA describes a framework through which "a CPA reports on an organizations' enterprise-wide cybersecurity risk management program".

The difference from SOC 2 is the subject. A SOC 2 covers the system behind a service the supplier sells you. SOC for Cybersecurity covers the organisation's whole cybersecurity risk management programme. The AICPA's attestation guide lists three parts to the report: management's description, management's assertion, and the practitioner's report.

There is also SOC for Supply Chain, an AICPA guide for controls in a production, manufacturing or distribution system. If you buy software or cloud services, you will mostly meet SOC 1, SOC 2 and SOC 3.

Does "SOC" also mean security operations centre?

Yes, and it has nothing to do with AICPA reports. If a regulator or client asks whether you "have a SOC", check which one they mean. The monitoring kind, and the rules behind it, are covered in SOC requirements in US regulations.

What should you check when a supplier sends a SOC report?

The cover page and the logo tell you little. Read these parts, in order.

  1. Report and type. SOC 1 or SOC 2, Type 1 or Type 2. Match it to your question: finance controls or security.
  2. Scope. Which services, locations and Trust Services categories are covered? Check that the product you actually buy is named. Microsoft, for example, publishes a standalone SOC 2 Type 2 for Azure DevOps, separate from the main Azure report.
  3. Period. For a Type 2, note the start and end dates. A report whose period ended a year ago says nothing about the months since.
  4. Subservice organisations and carve-outs. Suppliers run on other suppliers, such as a hosting provider. The AICPA SOC 1 guide covers two ways to present them: the inclusive method and the carve-out method. Under a carve-out, the subservice organisation's controls are left out of the testing, so you need its own report too.
  5. Complementary user entity controls (CUECs). The controls the supplier assumes you run. Microsoft calls them "your control responsibilities necessary if the system as a whole is to meet the SOC 2 control standards", listed under "User Entity Responsibilities".
  6. Exceptions and management responses. Microsoft notes that "some number of observations is to be expected". The question is whether any touch the way you use the service.
  7. The opinion. Which CPA firm signed it, and is the opinion modified in any way?
  8. Bridge letter. If the period ended months ago, ask for one, and remember who wrote it (see below).

Going deeper: for security and IT teams

The standards behind each report. Microsoft's SOC 1 page states that a SOC 1 Type 2 is performed under SSAE No. 18, Attestation Standards: Clarification and Recodification, which includes AT-C section 320, plus the AICPA SOC 1 guide. Microsoft also runs its Microsoft 365 SOC 1 Type 2 in accordance with ISAE 3402, and notes that SOC 1 replaced SAS 70. For SOC 2, Microsoft's Azure page lists SSAE No. 18 with AT-C section 105 (Concepts Common to All Attestation Engagements) and AT-C section 205 (Examination Engagements), the AICPA SOC 2 guide, and TSP section 100, the 2017 Trust Services Criteria. The AICPA's own SSAE No. 18 page says it superseded SSAE Nos. 10 to 17, with some exceptions. The 2024 SOC for Cybersecurity guide includes updates from SSAE No. 20. If a supplier's report still says "SSAE 16" or "SAS 70" on the cover, it is out of date.

How reliance works. The AICPA SOC 1 guide has a section on how a user auditor uses a Type 1 or Type 2 report instead of testing the supplier directly. A security team reading a SOC 2 is doing the same thing. You can lean on the CPA's testing only for the stated period, scope and categories, and only if you run the CUECs.

In practice: Azure coverage cadence. Microsoft's Azure SOC 2 page (last updated October 2024) describes a rolling 12-month audit period, new reports issued twice a year with period ends of 31 March and 30 September, and about six weeks to publish after each period ends. Bridge letters arrive in the first week of each quarter and cover the prior three months. On that schedule, the newest Azure report's period should never have ended more than about seven and a half months ago. Check the current schedule in the Service Trust Portal, because that page is two years old.

In practice: Microsoft 365 coverage cadence. The Microsoft 365 page describes an annual Type 2 period of 1 October to 30 September, with reports "usually issued a few months after" the period ends and no gaps between consecutive periods. Its bridge letters are "self-attestations by Microsoft" and "aren't reports based on examinations by the auditor". That is the key point about any bridge letter: it carries management's word, not the auditor's opinion.

Threat model. The risk is relying on paperwork that doesn't cover what you think: a stale period, a carve-out that hides the hosting provider, a product outside the scope, or CUECs nobody on your side owns. None of these is fraud. They are reading errors, and they surface when an incident review asks why the supplier was trusted.

Turning the report into controls. Copy every CUEC into your control register with an owner and the evidence you will keep. If a CUEC says you must review your own users' access to the service, that review is now your control and needs a dated record. Log each exception with its criterion, whether it affects your use, the management response, and whether it also appeared last year. Record each carved-out subservice organisation and file its report next to the supplier's.

Questions for the supplier:

  • Which report, which type, which categories, and which period?
  • Is the product we buy named in the system description?
  • Which subservice organisations are carved out, and can we see their reports?
  • Which exceptions were noted, and were they repeats?
  • When does the next period end, and will you send a bridge letter for the gap?

Learn more

More compliance explainers are in the Compliance & Regulation section.

Key takeaways

  • SOC 1 is for controls that affect your financial reporting; SOC 2 is for security and the other Trust Services categories; SOC 3 is a public summary of a SOC 2.
  • Ask for Type 2, which tests controls over a period; Type 1 covers a single date.
  • A CPA firm issues the opinion under AICPA attestation standards: AT-C section 320 for SOC 1, AT-C sections 105 and 205 for SOC 2.
  • Read the scope, the period, carve-outs, CUECs and exceptions before the cover page.
  • A bridge letter is the supplier's own statement, not audited.
  • SOC for Cybersecurity covers an organisation's whole cybersecurity programme.

Sources