SOC 2 vs SOC 3: The Difference and Whether You Need Both

A SOC 2 report is a restricted-use report for customers and other specified readers: it describes your system in detail and lists the auditor’s tests of controls and their results. A SOC 3 report covers the same AICPA Trust Services Criteria over a stated period, but leaves out the detailed system description and the tests, so it is ordinarily a general-use report you can post publicly (the AICPA’s guide allows a restriction in some cases, covered below). Most companies get a SOC 3 by asking their CPA firm to issue one at the end of a SOC 2 Type 2 examination, which adds a short report rather than a second audit. A SOC 3 does not replace a SOC 2 when a customer asks for the SOC 2.

What is the difference between SOC 2 and SOC 3?

Sources: AICPA SOC 2 guide, Appendix A (2022 edition); AICPA SOC 1 guide, Appendix E, for the single SOC 3 report type; AICPA SOC 3 overview.

What is a SOC 3 report?

A SOC 3 report is a CPA firm’s report, ordinarily for general use, on whether a service organization’s controls were effective throughout a stated period at meeting its service commitments and system requirements under the Trust Services Criteria. The AICPA’s SOC 3 overview describes it as covering the same subjects as SOC 2 with less detail, which is why it can ordinarily be distributed freely.

A SOC 3 has two parts:

1. Management’s assertion that the controls were effective throughout the period. The assertion also describes the boundaries of the system and the principal service commitments and system requirements.
2. The service auditor’s report, giving the CPA firm’s opinion on whether that assertion is fairly stated against the applicable criteria.

The AICPA’s illustrative SOC 3 report shows the format. Large providers publish real ones. As of October 2026, Google Cloud issues its core SOC 3 reports quarterly, each covering a 12-month period, and Microsoft issues its Office 365 SOC 3, which is based on the SOC 2 examination, at the same time as the SOC 2.

What does a SOC 2 include that a SOC 3 leaves out?

A SOC 2 Type 2 adds two sections a SOC 3 does not have: the full system description, written against the AICPA’s description criteria, and the auditor’s description of each test of controls with its results. Those sections are where a customer’s reviewer finds the controls that map to their requirements, any exceptions, the complementary user entity controls the customer must run, and the subservice organizations (a cloud host, for example) the report carves out. A SOC 3 reader gets the opinion and a short account of the system’s boundaries and commitments, without that detail.

That is why a SOC 3 rarely closes a vendor review on its own. Our guide to the SOC 2 audit report explains how reviewers read those sections.

Can you have a SOC 3 without a SOC 2?

CPA firms describe the practice in similar terms:

• Schellman states that a SOC 3 requires an existing SOC 2 and relies on the SOC 2 examination.
• Linford & Co. says a company with only a SOC 3 is rare, because a standalone SOC 3 needs the same testing and costs about as much as a SOC 2.

If you want only a public report, ask each firm whether it performs standalone SOC 3 examinations and expect Type 2 testing and fees. If customers will ask for a SOC 2 anyway, request both reports from one examination covering one period.

Is there a SOC 3 Type 1 or Type 2?

No. There is only one type of SOC 3 report, as the AICPA’s comparison of SOC reports in its SOC 1 guide states and paragraph 1.74 of its SOC 2 guide confirms. Management’s assertion in a SOC 3 covers whether controls were effective throughout a specified period, so every SOC 3 covers a period, as a SOC 2 Type 2 does. When someone says “SOC 3 Type 2”, they mean that one report.

• A SOC 2 Type 1 cannot produce a SOC 3. A Type 1 covers design at a single date. Plan the SOC 3 with your first Type 2 period; see SOC 2 Type 1 vs Type 2 for choosing between them.
• There is no “SOC 2 Type 3” or “SOC Type 3” report. SOC 2 comes in Type 1 and Type 2 only, and SOC 3 is a separate report, not a third type.

Which report do you need, SOC 2 or SOC 3?

Neither report is better; they serve different readers. Start from who will read it and what they will do with it:

Some buyers accept a public SOC 3 at an early screening and ask for the SOC 2 before signing. Ask target customers which report their review accepts, and set the deliverables during audit preparation so the proposal covers both if you need both. Other framework comparisons are listed in our compliance framework comparison.

How do you share a SOC 2 and publish a SOC 3?

A SOC 2 is intended for specified users with enough knowledge of the service and its controls. Companies commonly share it through a request process, sometimes under an NDA; the AICPA’s restricted-use designation does not itself require every recipient to sign one. Because the report contains operational detail, decide who may receive it and how you will track that:

• Check each recipient. Confirm the requester is an intended user and apply your sharing terms, including an NDA where your policy requires one.
• Watermark each copy with the recipient’s name and the date to discourage onward sharing and trace leaks.
• Keep an access log of who received the report and when.

Our guide on whether customers can see your SOC 2 report covers the request process in more detail.

A SOC 3 is ordinarily general use. Check the auditor’s report for any statement limiting who may use it, then post the PDF on your security or trust page and state the system, period, criteria, and CPA firm it covers. Call it a report, not a certification, and keep any summary within the scope of the auditor’s opinion.

Does a SOC 3 come with a seal or logo?

There is no SOC 3 seal. The AICPA and CPA Canada ended the SysTrust seal program for SOC 3 reports in October 2014 and issued no seals after December 31, 2014, according to Weaver’s summary of the announcement. SOC 3 reports themselves continued. Today a company with a SOC 1, SOC 2, or SOC 3 report from a licensed CPA can register for the AICPA’s SOC for Service Organizations logo, and the AICPA’s terms limit its display to 12 months after the report date. Our SOC 2 logo guide covers registration and the wording to use with it.

How much does a SOC 3 add to a SOC 2 audit?

When a SOC 3 is issued with a SOC 2 for the same system and period, the fieldwork is shared and the SOC 3 adds a short report; Schellman describes the added cost as minimal. A standalone SOC 3 needs the same testing as a SOC 2 Type 2, so Linford expects a similar fee. Ask each firm to price the SOC 3 as its own line, on the same system, criteria, and period as the SOC 2, so proposals compare like for like. Our SOC 2 audit cost guide covers the examination fee itself.

The SOC 3 is usually issued alongside the SOC 2, as in Microsoft’s case above. Ask the firm for draft-review and issue dates for both reports, and if a launch depends on the SOC 3, get its proposed issue date in writing.

What should you check in a vendor’s SOC 3?

If you are reading another company’s public SOC 3, six checks tell you whether it covers what you need:

1. The period and report date. A SOC 3 covers a stated period, and the period can end months before you read it. As of October 2026, Google Cloud, for example, issues no bridge letters for SOC 3 and points customers to the bridge letter for the related SOC 2.
2. The criteria. The common criteria for security apply to every report; availability, processing integrity, confidentiality, and privacy appear only if the company chose them.
3. The system boundaries. The assertion names the services and system covered. Confirm that the product you are buying is inside them.
4. The opinion. Look for an unmodified opinion on management’s assertion. Because a SOC 3 omits the test results, you will not see exceptions that did not change the opinion.
5. The CPA firm. Confirm who signed the report and that the firm is licensed to perform the examination.
6. Any limit on who may use it, and what the boundaries leave out. “General use” is the usual case, not a guarantee. If the system relies on a carved-out subservice organization or on controls customers must run, the AICPA’s guide says a SOC 3 can mislead readers and its use may be restricted. What limits a general-use SOC 3 has the paragraphs.

If you need the controls, exceptions, or complementary user entity controls, ask the vendor for its SOC 2 under its sharing terms. SOC 2 report red flags lists what reviewers look for once they have it.

What limits a general-use SOC 3?

A SOC 3 has no system description and no test results, so a reader sees less than the examination covered. The AICPA’s SOC 2 guide (October 2022 edition) also says where that gap can leave a SOC 3 misleading. The right-hand column is our reading of what each paragraph means for someone holding a SOC 3, not the guide’s wording.

Read the assertion’s boundary section first. A vendor that posts a SOC 3 for a platform built on a public cloud should say which parts of the service the examination covers and how it treats the cloud provider. If you are the one commissioning a SOC 3, ask your firm at the proposal stage how it will present subservice organizations and customer-side controls, and whether it expects to restrict use.

Source: AICPA, SOC 2 Reporting on an Examination of Controls at a Service Organization (October 2022 edition), paragraphs 1.15, 1.73 to 1.75, 2.192 to 2.194 and 4.121 to 4.123, read October 21, 2026.

Who issues SOC 3 reports?

A licensed CPA firm issues a SOC 3, usually the same firm that performs the SOC 2. 60 of the 187 audit firms in our directory list SOC 3 among their services. A firm with no recorded service list may still issue one, so ask when you request a SOC 2 proposal.

---

If you need a SOC 2 report, with or without a SOC 3, compare audit firms by scope, price, timeline, and industry experience before requesting quotes.