In brief
SOC 1 vs SOC 2 vs SOC 3: what each AICPA report covers, who may read it, how Type I and Type II apply, and how SaaS and outsourcing vendors choose.
SOC 1 vs SOC 2 vs SOC 3 comes down to purpose: SOC 1 covers controls that affect your customers' financial reporting, SOC 2 covers security and the other Trust Services Criteria, and SOC 3 is a general-use summary of a SOC 2 examination. All three are reports issued by an independent CPA firm under AICPA standards, not certificates.
This guide helps founders, CTOs and compliance leads at SaaS and IT outsourcing companies work out which report a customer is actually asking for. If SOC 2 is new to you, start with what is SOC 2.
What are SOC 1, SOC 2 and SOC 3?
SOC (System and Organization Controls) is the AICPA's suite of reporting services that CPAs perform to give customers information for assessing the risks of outsourcing.
- SOC 1 is an examination of controls at a service organization that may be relevant to customers' internal control over financial reporting (ICFR). It is intended for the user entities and their financial statement auditors (user auditors), and is performed under the SSAE 18 attestation standards.
- SOC 2 examines controls relevant to security, availability, processing integrity, confidentiality and privacy under the Trust Services Criteria. It is a restricted-use report for management, customers and customers' auditors (Linford & Co).
- SOC 3 is a general-use report on the same trust categories that can be freely distributed, but it does not give the level of detail of a SOC 2 report.
How do SOC 1, SOC 2 and SOC 3 compare?
| Criterion | SOC 1 | SOC 2 | SOC 3 |
|---|---|---|---|
| Question it answers | Do the vendor's controls properly support the customer's financial reporting? | Are security and the selected criteria's controls designed and operating effectively? | Public summary: does the vendor meet the selected criteria? |
| Criteria used | Control objectives the organization defines, tied to ICFR | Trust Services Criteria (Security always in scope) | Trust Services Criteria |
| Who may read it | Customers and their financial auditors | Management, customers and their auditors (restricted) | Anyone (general use) |
| Type I / Type II | Both | Both | No Type I option; issued for a period like Type II |
| Level of detail | System description, controls, tests and results | System description, controls, tests and results | Auditor's opinion and a short description, no test detail |
| Who usually asks | Customers whose financial data runs through your service (payroll, payments, billing) | Customers' security and vendor risk teams | Used publicly on a website or trust page |
Do Type I and Type II apply to all three?
Type I tests the design of controls at a point in time; Type II tests design and operating effectiveness over an observation period, typically 3 to 12 months, and the AICPA sets no minimum. The split applies to SOC 1 and SOC 2. SOC 3 has no Type I option: per Linford & Co, a SOC 3 is always a Type II, and companies often get SOC 2 and SOC 3 with the same scope and period so both use the same testing. For the difference in detail, see SOC 2 Type I vs Type II.
Which report should a SaaS or outsourcing vendor get?
- Ask the customer exactly what they need. Vendor security questionnaires almost always ask for a SOC 2 Type II or ISO 27001; SOC 1 requests usually come from the customer's finance or audit function.
- Choose SOC 1 if your service directly processes figures that flow into customers' financial statements, such as payroll, payment processing, reconciliation or invoicing.
- Choose SOC 2 if customers worry about the security of the data and systems you run for them. This is the common case for SaaS and software outsourcing.
- Add SOC 3 once you have a SOC 2 Type II and want public evidence on your website without signing an NDA for every prospect.
- Some companies need both SOC 1 and SOC 2 because they serve two kinds of customers; one CPA firm can perform both.
If you are choosing between SOC 2 and ISO 27001, see SOC 2 vs ISO 27001: which first.
Which reports does pTrackly support?
pTrackly supports the SOC 2 framework under the Trust Services Criteria: controls, policies, recurring evidence tasks and an auditor workspace through the observation period. The same SOC 2 evidence feeds a SOC 3 that the CPA firm issues for the same period, but pTrackly has no SOC 1 framework and no separate SOC 3 workflow.
pTrackly is not a CPA firm and issues no SOC report. An independent CPA firm does; see how long SOC 2 takes for what the audit involves.
Frequently asked questions
Is SOC 2 better than SOC 1?
No. They answer different questions: SOC 1 is about customers' financial reporting, SOC 2 about security and the Trust Services Criteria. Which you need depends on what your customer is asking.
Can I send a SOC 3 instead of a SOC 2?
Usually not. A SOC 3 has no detailed control descriptions or test results, so customers' vendor risk teams normally still ask for the SOC 2 under NDA. A SOC 3 suits public use on your website.
Are SOC 1, SOC 2 and SOC 3 certifications?
No. All three are attestation reports issued by a CPA firm under AICPA standards, with an auditor's opinion on a defined scope and a point in time or period. People often say "SOC 2 certification", but there is no SOC certificate.
Do SOC reports expire?
There is no official expiry date. Customers usually want a report whose period ended within the last 12 months, so companies renew yearly.
Preparing for SOC 2? Book a demo to see how pTrackly organizes controls, evidence and audit work through the observation period.
