SOC 3 (Service Organization Controls 3) is the AICPA general-use summary of the Trust Services Criteria examination that produces a SOC 2. It contains the auditor's opinion and management's assertion but omits the system description and test results, so it is safe to publish on a trust page.
What does a SOC 3 actually include?
A SOC 3 contains the auditor's opinion and management's assertion against the Trust Services Criteria, with no controls list and no test detail.
Per the AICPA SOC 3 page, the report includes a management assertion that controls met service commitments under the Trust Services Criteria, plus the auditor's opinion on that assertion. It does not list individual controls or exceptions, which is why it is safe for general distribution.
How is SOC 3 different from SOC 2?
A SOC 3 is general-use and publishable. A SOC 2 is restricted-use and shared under NDA only with the customer, their auditors, and named parties.
| Dimension | SOC 2 | SOC 3 | | ---------------- | ------------------------------------------ | ----------------------------------------- | | Distribution | Restricted use, NDA | General use, public | | Contents | System description, controls, test results | Auditor opinion plus management assertion | | Length | Usually 60-120 pages | Usually 5-10 pages | | Typical audience | Customer's vendor-risk team | Anyone, on the trust page |
When is a SOC 3 actually enough?
A SOC 3 is a marketing artifact for a public trust page. It rarely substitutes for the full SOC 2 a buyer's vendor-risk team will demand.
Most enterprise TPRM reviews insist on the SOC 2 because the exception findings and tested controls are what their security team reads. The same AICPA Trust Services Criteria underpin both reports. A SOC-3-only team will get a follow-up request for the SOC 2 on most deals above a procurement threshold. The SOC 3 still earns its keep as the artifact a prospect can grab without an NDA.
Related terms
These adjacent terms come up whenever a vendor decides whether a SOC 3 is enough or whether a buyer will demand the full restricted-use report.
- SOC 2 - the restricted-use report a SOC 3 summarizes; the artifact buyers actually read
- SOC 1 - the financial-controls report under AT-C 320, distinct from the Trust Services Criteria
- TPRM - the vendor-review motion that decides which SOC report is acceptable
- Trust page - the public page where most companies publish their SOC 3 alongside other certifications