When a customer asks for "a SOC report", they usually mean one of three different reports. Picking the wrong one wastes months, so it's worth getting clear on the difference first.
SOC 1: controls over financial reporting
A SOC 1 report covers the controls at your organisation that could affect your customers' financial statements. It's performed under the AICPA's SSAE 18 attestation standard (AT-C 320).
You likely need SOC 1 if your service touches your customers' money or financial records, for example payroll, billing, payment processing, loan servicing, claims processing or fund administration. The readers are your customers' finance teams and their external auditors.
We cover SOC 1 in depth in SOC 1 reports explained: Type 1 vs Type 2.
SOC 2: security and the Trust Services Criteria
A SOC 2 report covers your controls against the AICPA's Trust Services Criteria: Security (always included), plus Availability, Processing Integrity, Confidentiality and Privacy if you choose them.
You likely need SOC 2 if you store, process or host customer data, which covers most SaaS, cloud and IT service companies. The readers are your customers' security, risk and procurement teams. SOC 2 reports are restricted-use, so you normally share them under NDA.
SOC 3: the public summary
A SOC 3 report is based on the same examination as a SOC 2, but it leaves out the detailed description of tests and results. It's a general-use report you can publish on your website.
SOC 3 is useful for marketing and for smaller prospects, but it rarely replaces SOC 2 in a security review, because it doesn't show the testing.
SOC 1 vs SOC 2 vs SOC 3 at a glance
| SOC 1 | SOC 2 | SOC 3 | |
|---|---|---|---|
| Focus | Controls relevant to customers' financial reporting | Security, availability, processing integrity, confidentiality, privacy | Same as SOC 2, summarised |
| Standard | SSAE 18 (AT-C 320) | AT-C 205, Trust Services Criteria | AT-C 205, Trust Services Criteria |
| Type 1 / Type 2 | Yes | Yes | No detailed testing shown |
| Who reads it | Customers' finance teams and auditors | Customers' security and procurement teams | Anyone |
| Distribution | Restricted | Restricted, usually under NDA | Public |
| Typical companies | Payroll, payments, billing, claims, fund admin | SaaS, cloud, IT services, data processors | Companies wanting a public trust badge |
Do you need more than one?
Some companies do. A payroll SaaS platform, for example, may need SOC 1 for its customers' auditors and SOC 2 for their security teams. Many controls overlap (access management, change management, backups), so the two examinations can usually be planned together and share evidence, which cuts effort.
How to decide
- Read the request. Does it mention financial reporting, ICFR or SSAE 18? That points to SOC 1. Security questionnaires point to SOC 2.
- Ask who will read the report: finance and auditors, or security and procurement?
- If customers want something public, add SOC 3 to your SOC 2. It costs little extra.
- Then choose Type 1 or Type 2. See SOC 2 Type 1 vs Type 2.