What Type SOC Report Do You Need?
Published on by Robert Ramsay, Bryan Gayhart, in SOC Reports, Video
Can’t watch the video? Get the transcript.
SOC 1 vs. SOC 2 vs. SOC 3: What’s the Difference—and What Do You Actually Need?
If you’ve ever heard someone say, “We need a SOC 1, SOC 2, or SOC 3—just send us all of them,” you’re not alone.
It’s a common request, especially in RFPs and inbound inquiries. But it also highlights a bigger issue: many procurement teams and prospective customers aren’t entirely clear on what each SOC report covers—or how they relate to one another.
Let’s break it down in simple terms.
Start with education: understanding the basics
When you’re starting your SOC report journey, the first step is research and education. Each report serves a different purpose, and they’re not interchangeable.
Here’s a high-level overview:
-
SOC 1 focuses on controls relevant to financial reporting.
-
SOC 2 evaluates controls related to security, availability, processing integrity, confidentiality, and privacy (the Trust Services Criteria).
-
SOC 3 is derived from a SOC 2 and provides a high-level, public-facing summary.
One important clarification:
If you haven’t completed a SOC 2, you cannot issue a SOC 3. Likewise, having only a SOC 1 report doesn’t qualify you to issue a SOC 3 report. SOC 3 is directly tied to SOC 2.
To make matters even more complex, both SOC 1 and SOC 2 reports can be issued as:
-
Type 1 – Evaluates the design of controls at a point in time.
-
Type 2 – Evaluates both design and operating effectiveness over a period of time.
It’s easy to see how the numbering system gets confusing. That’s why education is half the battle during early exploration.
SOC 2 vs. SOC 3: What’s the real difference?
Since SOC 3 is based on SOC 2, the distinction between the two is especially important.
SOC 2: Detailed and restricted
A SOC 2 report is comprehensive and includes:
-
A detailed system description
-
A full list of controls
-
Testing procedures performed by the auditor
-
Results of those tests
Because of the level of detail—including potentially sensitive or proprietary information such as network diagrams—SOC 2 reports are typically shared under NDA and later in the sales process.
SOC 3: Public-facing and high-level
A SOC 3 report is essentially a summarized version of the SOC 2.
Key differences:
-
It removes detailed control testing (Section IV in a SOC 2 report).
-
It omits sensitive or proprietary system details.
-
It provides a high-level overview of infrastructure, software, people, procedures, and data.
-
It focuses on system requirements and service commitments rather than test results.
Because of this streamlined format, SOC 3 reports are designed to be publicly shared. Many organizations post them on their website or provide them early in the sales process without requiring an NDA.
Who benefits most from a SOC 3?
SOC 3 reports are particularly valuable for organizations that receive frequent inbound security inquiries—especially:
-
Software-as-a-Service (SaaS) providers
-
Platform-as-a-Service (PaaS) providers
-
Technology companies serving enterprise clients
Prospective customers often want to perform initial due diligence before engaging in deeper sales conversations. A SOC 3 offers a quick, accessible way to demonstrate your security posture without disclosing sensitive details.
It’s an efficient way to streamline early-stage trust-building while reserving the more detailed SOC 2 report for qualified prospects.
Adding a SOC 3 to an existing SOC 2
If you already have a SOC 2, adding a SOC 3 is pretty straightforward.
On average, organizations can expect about 10% additional effort beyond the SOC 2 process. Much of that work falls on the audit team, who:
-
Modify the system description to align with SOC 3 requirements
-
Remove sensitive or proprietary information
-
Help navigate formatting and reporting adjustments
From there, the report goes back to the client for review—often including legal or compliance teams—to ensure it aligns with what the organization is comfortable sharing publicly.
Because the SOC 3 is a derivative of the SOC 2, the incremental lift is modest compared to a full SOC 2 engagement.
Ask for what you actually need
When someone says, “We need a SOC 1, SOC 2, or SOC 3,” the right response isn’t to automatically provide all three. It’s to clarify:
-
What risks are they trying to assess?
-
Are they concerned with financial reporting or security posture?
-
Do they need detailed testing results, or just high-level assurance?
Understanding the purpose behind the request ensures the right report is delivered—without unnecessary confusion or effort.
If your organization fields frequent security inquiries, a SOC 3 may be a smart addition to your reporting strategy. It helps you demonstrate transparency, build trust, and streamline early-stage conversations—all while protecting sensitive information.
And that’s ultimately what these reports are designed to do: provide assurance, clearly and confidently.
If you’re interested in finding out more about what SOC report version is right for your organization, contact us for a free consultation with a member of our top SOC team. As always, we’re here to help.
You might also be interested in our SOC Reporting Toolkit – packed with tools and resources to streamline your SOC reporting process. If you’re just starting your SOC reporting journey, our SOC Reporting FAQ answers all of the common questions our team hears. And our SOC Reporting Ask the Experts video series covers multiple aspects of SOC reporting – don’t miss it! Watch now on our YouTube channel.
