SOC 1 vs SOC 2 (and SOC 3): Which SOC Report Do You Need?

SOC 1 vs SOC 2: the short answer

SOC 1 reports on a service company's controls that could affect its customers' financial reporting. SOC 2 reports on controls for security. It can also cover availability, processing integrity, confidentiality and privacy. SOC 3 is a short, public version of a SOC 2 that you can post on your website. Do your customers' finance teams and auditors rely on your system? Think SOC 1. Are their security teams assessing you as a vendor? Think SOC 2.

The table compares all three. ICFR stands for internal control over financial reporting, the checks a company uses to keep its accounts accurate. The AICPA is the US body for accountants, and it sets these standards.

What is a SOC report?

A SOC report (System and Organization Controls) is an attestation report. An independent CPA firm, meaning a licensed accounting firm, issues it. The firm follows standards set by the AICPA, the American Institute of Certified Public Accountants. The report gives an opinion on the company's description of its system. It also says whether its controls were suitably designed. For Type II, it also says whether they operated effectively.

Two points cause a lot of confusion:

• Here, SOC does not mean security operations center (a team that watches for attacks). A company can run a 24/7 SOC and have no SOC report, or the other way round.
• There is no SOC certification. People say "SOC compliance", but what a company actually has is a SOC report. It covers a set scope and period, and a licensed CPA firm writes it.

SOC 1: controls that affect financial reporting

A SOC 1 report is performed under the AICPA attestation standard SSAE 18 (section AT-C 320). It exists because companies rely on outside providers for parts of their financial processes. Say a payroll provider gets salaries wrong, or a payment processor records transactions incorrectly. Then the customer's financial statements are wrong too.

In a SOC 1, the service company defines control objectives. Examples are "transactions are processed completely and accurately" or "access to the application is restricted to authorized users". The auditor tests the controls behind those objectives. IT general controls are usually included too, because they support the financial controls. These cover access management, change management and operations.

The main readers are the customer's finance team and their external auditor. Some US public companies fall under the Sarbanes-Oxley Act, a law on financial reporting. For them, a SOC 1 Type II from key vendors is often part of the evidence their auditor needs.

SOC 2: the Trust Services Criteria

A SOC 2 report uses the AICPA Trust Services Criteria instead of control objectives you write yourself. Security (the common criteria) is always in scope. Availability, processing integrity, confidentiality and privacy are added when they matter to your customers.

SOC 2 is the report most SaaS and cloud companies are asked for in vendor security reviews. That is because it covers how the company protects customer data, not how it affects accounting. For a full walkthrough of scope, cost drivers and timelines, see what is SOC 2 compliance.

SOC 3: the public summary

A SOC 3 report covers the same Trust Services Criteria as a SOC 2. But it leaves out the detailed description of controls and test results. It contains nothing sensitive, so it is a general use report. You can post it on your website or trust center without an NDA (a non-disclosure agreement).

A SOC 3 is a marketing and trust signal. It does not replace a SOC 2 for customers who need to review your controls in detail. Most large companies' security teams will still ask for the full SOC 2. Companies that want a SOC 3 usually get it alongside their SOC 2 Type II, from the same audit work.

Type I vs Type II applies to SOC 1 and SOC 2

Type I and Type II are not separate frameworks. They describe how deep the audit goes. Both SOC 1 and SOC 2 come in both types.

• Type I: the auditor checks whether controls are suitably designed and in place on a single date.
• Type II: the auditor also tests whether those controls worked well over a period, commonly 3 to 12 months.

Customers and their auditors usually prefer Type II, because it shows controls actually worked over time. A Type I is a useful first step when you need something to show quickly. With SOC 1, user auditors (your customers' auditors) usually want the period to cover a large part of their financial year. They ask for a bridge letter to cover the remaining gap. A bridge letter is a short signed statement from your management that nothing major has changed.

Which SOC report do you need?

Start with who is asking and why. Then use this checklist:

• Choose SOC 1 if your service touches customers' financial transactions or records, and their finance team or external auditor is asking. Examples: payroll, billing, payment processing, loan servicing, fund administration.
• Choose SOC 2 if customers want proof that you protect their data and keep your service secure and available. This covers most SaaS, hosting and data processing companies.
• Choose both if you do both. A fintech platform that processes payments and stores sensitive customer data may need a SOC 1 for finance teams. It may also need a SOC 2 for security reviewers. Many audit firms can run the two with shared testing.
• Add a SOC 3 if you want a report you can publish openly once you have a SOC 2 Type II.

How NextGarrison helps

NextGarrison is not a CPA firm and does not issue SOC reports. We help companies prepare for them. That includes scoping, gap assessments, fixing gaps, policies and evidence collection. It also includes penetration testing, a hired, legal attempt to break in. Your audit firm then finds a ready environment. Our SOC 2 Readiness Program covers the SOC 2 path end to end. We can also help you work out whether SOC 1 belongs on your roadmap. If you are weighing SOC 2 against other frameworks, see ISO 27001 vs SOC 2.