SOC 3
Trust Services Criteria for General Use Report. Updated: September 29, 2026.
SOC 3 is an AICPA general use attestation report on a service organisation's controls relevant to the applicable Trust Services Criteria. Its defining property is distribution: it contains no confidential detail, so it can be published on a website and handed to anyone, with no NDA.
SOC 3 is an attestation report, not a certification. Worth stating plainly here, because the section it sits in is called “certifications” and the word is used loosely everywhere else. An independent practitioner examines the controls and issues an opinion; no certificate is issued against a standard, and nobody is “SOC 3 certified”.
It is often described as “the public version of a SOC 2”. That is a reasonable description of how organisations commonly obtain one — in connection with SOC 2 work — but it is not the definition. SOC 3 is its own report type within the AICPA's SOC suite, with its own scope and its own opinion.
What It Can Cover
The same five Trust Services Criteria as SOC 2, and — the part that is easy to miss — only the ones that were applicable to that engagement:
- Security — the common criteria, present in every one.
- Availability — uptime commitments, capacity, recovery.
- Processing integrity — processing is complete, valid and timely.
- Confidentiality — information designated as confidential.
- Privacy — personal information, against a stated notice.
A SOC 3 does not automatically cover all five. If availability matters to you, check that the report says it was in scope rather than assuming.
What the Report Actually Contains
Descriptions of SOC 3 usually list what has been taken out. What remains is the more useful question:
- Management's assertion about the subject matter — the service organisation's own statement about its system and controls.
- The independent practitioner's report and opinion, covering both the suitability of the controls' design and their operating effectiveness over the period. This is the substance of the document.
- A short system overview, and the period the opinion covers.
What is absent: the detailed system description, the list of individual controls, the tests the practitioner performed, and the results of those tests — including any exceptions.
| SOC 2 | SOC 3 | |
|---|---|---|
| Trust Services Criteria | Yes | Yes |
| Independent examination and opinion | Yes | Yes |
| Detailed system description | Yes | No — overview only |
| Individual controls listed | Yes | No |
| Tests performed | Yes (Type 2) | Not published |
| Test results and exceptions | Yes (Type 2) | Not published |
| Complementary user entity controls | Yes | No |
| Intended audience | Specified parties — customers and their auditors | Anyone |
| Distribution | Restricted use — normally under NDA | General use — publish it |
| Typical use | Vendor due diligence and risk assessment | Public assurance; sales and marketing |
What It Is Good For
Exactly one thing, and it does it well: showing publicly that an examination was performed and what the opinion was. A prospect can read it without signing anything, which removes a step from early sales conversations and saves you sending a confidential report to people who were never going to buy. Several large cloud providers publish theirs for precisely this reason.
What It Is Not Good For
Assessing a supplier seriously. Because the tests and results are absent, a SOC 3 does not tell you what was examined in detail, where the scope boundaries were, whether any exceptions were found, or — most importantly — which complementary user entity controls you are expected to operate yourselves. All of the genuinely decision-useful content of a SOC 2 is what SOC 3 leaves out.
So, as a buyer: accept a SOC 3 as evidence that an examination exists, and ask for the SOC 2 before you depend on the service. A supplier who will only ever show the SOC 3 has told you something.
How to Get One
Organisations commonly obtain a SOC 3 in connection with SOC 2 work, when they want a report they can distribute publicly. Where it is performed alongside a SOC 2 examination the incremental cost and evidence burden are usually small, so it is worth raising with your audit firm at the point you engage them rather than coming back for it later. Discuss the scope, the criteria and the period with the practitioner — those are set for the engagement, not inherited automatically.
Related
SOC 2 is the substantive report and explains the criteria and the Type 1 / Type 2 distinction in full; SOC 1 covers controls affecting financial reporting; ISO/IEC 27001 is the certification-based alternative, and being a public document by nature is one of its practical advantages over SOC 2.
References
- AICPA & CIMA — System and Organization Controls (SOC) suite of services, which defines the report types.
- AICPA & CIMA — SOC 2 resources, for the Trust Services Criteria themselves.
Written from an infrastructure perspective. We are not a certification body, an audit firm or a legal adviser, and this is not legal advice. Standards are revised on a cycle — confirm the current edition before you commit.