SOC 1 vs SOC 2 vs SOC 3: Which Report Do You Need?

A procurement email arrives asking for your SOC report and does not say which one. Finance assumes SOC 1 because it sounds like the first step. Engineering suggests SOC 3 because it sounds like the highest tier. Both readings are wrong, and each report costs months of staff attention, so the wrong pick is expensive and closes no deals.

The three names come from one place. The SOC suite of services is defined by the AICPA as a set of offerings CPAs may provide in connection with system-level controls of a service organization. SOC 1, SOC 2 and SOC 3 sit inside it alongside SOC for Cybersecurity and SOC for Supply Chain. They are siblings, not steps.

SOC 1 vs SOC 2 vs SOC 3 Compared

Two things the table cannot carry. SOC 1 and SOC 2 answer different questions about the same company, so holding one says almost nothing about the other: a payroll processor with immaculate financial controls can still run an unpatched server. And a SOC 3 is not a third opinion, but a shorter presentation of an examination already performed.

The trust services criteria sit underneath the SOC 2 and the SOC 3 alike. The AICPA describes them as criteria established by its Assurance Services Executive Committee for use in attestation or consulting engagements covering security, availability, processing integrity, confidentiality or privacy. Security is the only category everyone must include, and the other four are chosen from what you promise customers, a decision covered on our page about the criteria themselves.

What Is a SOC 1 Report?

The AICPA is unusually plain about this one. A SOC 1 is an examination of controls at a service organization that are likely to be relevant to user entities' internal control over financial reporting, and the reports are intended to meet the needs of the entities that use the service organization and the CPAs who audit those entities' financial statements.

Read that second half again, because it decides whether the report is yours to want. A SOC 1 is written for somebody else's auditor, who is deciding whether they can rely on your controls when signing off your customer's accounts. That is why it is organized around control objectives, and nobody hands you those objectives. Your management writes them, the CPA firm assesses whether they are reasonable for the service you provide, then tests the controls you built to meet them, under AT-C section 320 of the attestation standards.

The companies that need one are narrower than search results suggest: payroll bureaus, claims processors, loan servicers, transfer agents, fund administrators, custodians, and platforms that post transactions into a customer's ledger. If your product does not touch a number that lands in somebody's financial statements, the request is probably not for a SOC 1. Buyers in financial services are the ones most likely to ask for both reports and to know the difference when they ask.

What Is a SOC 2 Report?

SOC 2 is the report almost everyone means. The AICPA's own title says what it does: reporting on an examination of controls at a service organization relevant to security, availability, processing integrity, confidentiality or privacy.

The difference from a SOC 1 is not strictness, it is subject. A SOC 1 asks whether your processing could corrupt a customer's books. A SOC 2 asks whether your systems keep their data safe, available, accurate and confidential. Security is mandatory, and the rest you pick because you sell them: availability if you commit to uptime, confidentiality if contracts oblige you to protect client material, privacy if you hold personal information.

There is still no control list. The criteria describe outcomes an auditor has to be satisfied about, and you design the mechanics, which is why a twelve person startup and a two thousand person platform can both come out clean with entirely different environments. What the engagement produces is set out on our page explaining what a SOC 2 examination contains.

What Is a SOC 3 Report?

A SOC 3 is the one you can put on your website, and that is the whole of its advantage. The AICPA states that SOC 3 reports address controls relevant to security, availability, processing integrity, confidentiality and privacy, that they do not provide the same level of detail as a SOC 2, and that they are general use reports which can be freely distributed.

What gets removed is the part a reviewer would use. A SOC 2 hands over your system description, the criteria mapped to your controls, every test performed and every exception found. A SOC 3 hands over the opinion and a summary, so a reader learns that an examination happened and reached a conclusion, without seeing what was in scope, what was tested or what failed.

It therefore answers the question a stranger asks before contacting you, and answers nothing in a vendor security questionnaire. Companies that publish one usually publish it beside a line offering the SOC 2 on request.

What Is the Difference Between Type 1 and Type 2?

This cuts across the first two reports rather than sitting beside them, which is why "SOC 2 Type 2" is four words describing two separate choices.

A Type 1 reports on whether controls were suitably designed at a single date. The auditor looks at the system as it stood, forms a view on whether the controls would meet the objectives or criteria if they operated, and says so. It is fast, because there is nothing to wait for.

A Type 2 adds operating effectiveness across a period and includes the tests performed and their results. Instead of asking whether your access review process would work, the auditor asks whether it ran every quarter for the whole window and wants the evidence. A control that operated three times out of four is an exception, printed in the report.

Most large buyers ask for a Type 2. The honest use for a Type 1 is as a first report while the window for the Type 2 runs, and the mechanics of that window are in our page on how long the audit takes. A SOC 3 sits outside the choice, since it comes from a completed examination and in practice those are Type 2.

Who Reads Each SOC Report

The three reports differ most in where they end up, and the path explains the format better than any list of features.

Why any of this reaches you is worth naming. Verizon's 2026 Data Breach Investigations Report found third-party involvement in breaches up 60 percent, with breaches involving a third party now accounting for 48 percent of all breaches. Large buyers police their vendors harder every year, and the questionnaire on your desk is that policy reaching you.

Can You Get a SOC 3 Without a SOC 2?

Not meaningfully, and this is the practical fact the comparison usually buries.

A SOC 3 comes from an examination against the trust services criteria, and that examination is a SOC 2 engagement whatever the deliverable is called. Same scoping, same testing across the same window, then two documents from one body of work. A company hoping to skip the expensive report and buy the cheap public one has the economics backwards: the saving is a rounding error, and what you give up is the document your enterprise prospects will ask for anyway.

Do You Need Both a SOC 1 and a SOC 2?

Some companies genuinely do, and the test is simple. Ask whether your service can both misstate a customer's financial records and expose their data. If a payroll platform posts wrong numbers, its customer's books are wrong; if the same platform is breached, its customer's employee records are gone. Two failure modes, two reports.

Fintech infrastructure, billing platforms, claims administrators and treasury tools sit in that overlap. Most software companies do not. Where both are needed, the affordable arrangement is one control environment assessed twice: one risk register, one policy library, one evidence repository, one owner per control, mapped to both the objectives and the criteria.

How Long a SOC Report Takes and What It Costs

Every article on this comparison prints month ranges and dollar ranges, and none sources a figure, so treat the mechanism as the useful part.

Two clocks run. The first is readiness: writing policies, closing gaps, building the evidence trail. That depends on what already exists, and it is where the calendar is usually lost. The second is the observation window on a Type 2, which nobody shortens with money because the auditor is testing a period that has to elapse. A Type 1 has no second clock, which is the only reason it is faster.

Neither the AICPA nor any regulator publishes or caps fees, and no registry records what anyone paid. What moves the number is how many categories you selected, how complex your system description is, and how many controls have to be tested. The published figures are on our page covering what a SOC 2 audit costs, and the market for readiness work exists because the first clock is where most of the money goes.

What a SOC Report Does Not Prove

A clean report is an opinion about defined controls, against defined criteria, over a defined period, for a defined system. Every one of those words is a limit, and reviewers who skip them read the cover page and stop.

Scope covers the system named in the description, which may be one product rather than the company. A Type 2 covering January to June says nothing about September. A report scoped to security alone makes no claim about availability or privacy. Exceptions are the most useful part, since two well explained ones with a candid response often tell you more than a clean opinion: they prove the auditor tested something.

Which SOC Report Do You Need?

The decision is made by your customers rather than by the merits of the three documents, and asking them directly is faster than any framework.

If your buyers sit outside North America, none of these may be the right answer, since European, Asian and public sector procurement typically names a certification rather than an attestation. The trade-offs are in our comparison of an ISO 27001 certificate against a SOC 2 report.