Does my company need a SOC 2 or a SOC 3 — or both?

You’ve heard about SOC reports, and you know there are three of them: SOC 1, SOC 2, and SOC 3. But which ones does your company need? How are they different from each other?


In this post, we’ll focus on the differences between SOC 2 and SOC 3, and set SOC 1 aside.

SOC 2 and SOC 3 definitions

SOC 2 and SOC 3 audit and reporting standards are established by the American Institute of CPAs (AICPA). Both reports assess and document an organization’s verified security practices. These reports are for companies that handle customer data or that work with larger enterprises who want to ensure that their vendors are secure.


SOC 2 defines criteria for managing customer data based on five “trust service principles” — Security, Availability, Processing Integrity, Confidentiality, and Privacy. All SOC 2 reports include the Security category; the other categories are optional, and relevant to your company depending on the commitments your customers expect. To complete a SOC 2, your company’s security measures must be reviewed and verified by a certified auditor. SOC 2 reports include detailed information about a company’s systems, and the use of these reports is restricted — companies share their SOC 2 with customers and prospects under NDA. These reports can’t be posted anywhere publicly.


SOC 3 reports are developed from the same audit process that yields SOC 2 reports. Think of a SOC 3 report as a redacted SOC 2 report: SOC 3 summarizes the material of a SOC 2, and excludes details and results of the testing performed during the audit. A SOC 2 report must be written in order to prepare a SOC 3 report. Companies can freely post SOC 3 reports on their websites and use them for sales and marketing purposes.


Your company can utilize a SOC 3 if you have customers or prospects who need assurance about your organization’s verified security practices — but may not need the specific details of a SOC 2 report, or have the knowledge base to utilize its technical information. Your company should decide if your customer base is seeking the detail provided in a SOC 2, or if they only require the high-level summary of the SOC 3. You will still undertake the same audit process, but you may find that the SOC 3 is most useful to your customers and prospects. In other words, sharing a SOC 3 report communicates at a high level that you’ve completed the SOC 2 audit process.


The difference between SOC 2 and SOC 3

Thus, the primary differences between SOC 2 and SOC 3 reports are the level of detail in each report, and the ways in which a company can share the report with its customers. A SOC 2 is a highly detailed, restricted-use report, while a SOC 3 is a summarized, general-use report.


Vanta can help your company obtain SOC 2 and SOC 3 reports that you can use to communicate your security status and satisfy customer inquiries. Vanta connects to your tools and infrastructure to continuously monitor your systems for risks and vulnerabilities, and helps your company put robust security controls in place. Vanta automates and simplifies the process of assessing your company’s security practices to make compliance faster, easier, and more streamlined than ever. Arm your sales force with Vanta security reports so your company can spend its time delivering on your business case. Contact us to get started on SOC reporting.

Related blog posts

Starting up with SOC 2: Know the SOC 2 controls and how CPAs are involved

READ MORE

Get up to date on HIPAA compliance: What you need to know in 2020

READ MORE
SOC 2 preparation

Eight vendor management best practices for monitoring security

READ MORE
SOC 2 preparation
We'll email you in 15 minutes
Please enter your first name
Please enter your last name
Please enter a valid email address
Please enter a job title
Please enter your company name
Please enter your company website
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.