Compliance / SOC 3
Show security assurance publicly with a SOC 3 report.
A SOC 3 report covers the same Trust Services Criteria as SOC 2 but leaves out the detailed description of tests and results. Because it is a general-use report, you can post it on your website or hand it to prospects without a nondisclosure agreement.
Most organizations produce a SOC 3 alongside a SOC 2 Type 2 examination. We help you get the underlying program ready and coordinate with the CPA firm on both reports.
At a glance
- Issued by
- A licensed CPA firm
- Based on
- AICPA Trust Services Criteria, like SOC 2
- Distribution
- General use, so it can be shared publicly
- Typical path
- Issued alongside a SOC 2 Type 2 report
SOC 3
Where SOC 3 helps
SOC 2 reports are restricted-use documents, usually shared under a nondisclosure agreement with customers who need the detail. A SOC 3 gives sales and marketing teams something they can share freely, which shortens early conversations with prospects.
Customers who want to review controls and testing in depth will still ask for the SOC 2. The SOC 3 opens the door, and the SOC 2 is the evidence behind it.
How we help
Readiness
The same groundwork as SOC 2.
- Scope and Trust Services Criteria selection
- Gap assessment and remediation
- Evidence collection plans
Reporting
Two reports from one examination.
- Coordination of SOC 2 and SOC 3 reporting with the CPA firm
- Review of the system description for public use
- Plans for publishing and refreshing the report
Who issues the report
Only licensed CPA firms can issue a SOC 3 report. We prepare you for the examination and work alongside the firm you choose.
Services that support this work
FAQ
Frequently asked questions
Can we get a SOC 3 without a SOC 2?
A CPA firm can examine against the Trust Services Criteria and issue only a SOC 3, but most organizations do both, because enterprise customers still ask for the detailed SOC 2.
How long does a SOC 3 take?
The same as a SOC 2, since the examination work is the same. The difference is the report you receive at the end.
Find out where you stand on SOC 3.
A readiness review shows what an assessor would find today and what it will take to close the gaps.