SOC 3

By now, you should be very familiar with a SOC 2 report. In terms of classification of the report itself, a SOC 2 report is a private report. The nature of the report means that it contains sensitive information about the organization and their control environment, including systems used, specific control information, management assertion information, as well as details surrounding the testing performed by the auditor, and test results obtained. As you can tell, this information should not be available to anyone, and the necessary non-disclosures need to be in place (at a minimum), before sharing the final SOC 2 report.

SOC 3 was developed to bridge this gap, and ensure that a company can still ‘brag’ about their successful SOC audit, but in a safe manner.

Read our blog: SOC 2 Vs SOC 3 Reports: What’s the Difference?

What is SOC 3 compliance?

By definition, a SOC 3 report is a public (this being the key difference) report of internal controls over the TSC (Security, Availability, Confidentiality, Processing Integrity, and Privacy).

What makes this a public report is the way the information is presented and detailed in the report. According to the AICPA’s definition of the SOC 3 report, the main difference is that the report “does not have the need for or the knowledge necessary to make effective use of a SOC 2 report”.

Essentially what this means is that the SOC 3 report does not contain as much detail as in a SOC 2 report. It still presents the outcome of the audit in the same way (as the report itself indicates successful compliance), but the detail surrounding the system and control environment, as well as the controls tested by the auditor and the detail of the testing results, are somewhat sanitized.

Ultimately, the reason for this is due to the audience that views and reads the report. It is considered a general-use report, and publicly available. Because of this, there is no need for in-depth technical detail. You want the reader of the report to understand what they are reading, learn what was covered in the audit itself, and be able to see the high-level outcome of it. Nothing more, nothing less.

What is the reason for a SOC 3 report? 

Well, as you are aware, SOC 2, and the successful attestation report, can yield imperative to obtaining more customers (and ultimately, quicker sales). Having a SOC 2 attestation proves that your system is secure and gives potential customers peace of mind that your information security is up to standard.

The SOC 3 report emphasizes this. It is a great marketing tool for prospective customers to be able to obtain and review, and equally as valuable for the organization themselves.

A few final remarks about SOC 3 reports:

• A SOC 3 report is always a Type II report (covering a period of time). There are no Type I SOC 3 reports.
• A SOC 3 report may be posted on an organizations’ website because it is a public and general-use document.
• The reason the report is classified as public is due to the fact that the specific testing methodology and results of the auditor in assessing the control environment are not disclosed in the report.