SOC 1, SOC 2 and SOC 3: the differences and which to request

When a customer asks for "your SOC 2", they are not asking about your security operations center. They want an independent audit report issued under the standards of the AICPA, the US association of certified public accountants. Here, SOC stands for System and Organization Controls. There are three reports with different audiences, and requesting the wrong one delays the deal without reducing risk.

The three reports side by side

Report	What it covers	Audience	Distribution
SOC 1	Provider controls that affect customers' financial reporting	Customers and their financial auditors	Restricted
SOC 2	Controls related to security, availability, processing integrity, confidentiality and privacy	Customers, partners and regulators who need technical detail	Restricted, usually under a non-disclosure agreement
SOC 3	The same categories as SOC 2, in less detail	General public	Unrestricted

SOC 1: when the service affects the customer's financial statements

SOC 1 examines provider controls likely to be relevant to customers' internal control over financial reporting. The typical case is a company that processes payroll, billing or transactions. The report serves the contracting companies and the auditors of their financial statements.

If the service never touches data that reaches the financial statements, SOC 1 is unlikely to answer the customer's question. A flawless financial report also says little about how a SaaS application protects data.

SOC 2: the security and trust report

SOC 2 uses the Trust Services Criteria and is the most common request made to technology and SaaS companies. There are five categories:

Security: protection against unauthorized access. It is the mandatory base of every SOC 2 examination.
Availability: the system operates and can be used as committed.
Processing integrity: processing is complete, accurate, authorized and timely.
Confidentiality: information designated as confidential stays protected.
Privacy: personal data is collected, used, retained and disposed of according to the organization's commitments.

Not every report covers all five. The organization chooses the ones that make sense for the service. That is why "we have SOC 2" means little until you know which categories and which system are in scope.

Type 1 and Type 2: the difference that matters most

The distinction applies to both SOC 1 and SOC 2:

	Type 1	Type 2
Question	Were the controls well designed?	Did the controls work in practice?
Coverage	A specific date	A period
Common use	First report, while the observation period is still open	Vendor assessment and annual renewal

One detail is often repeated incorrectly: there is no mandatory minimum length for the Type 2 period. In practice, reports usually cover three to twelve months, and the organization chooses the period based on what its customers need. A three-month report is valid, but it provides less evidence than a twelve-month one.

SOC 3: the version you can put on your website

SOC 3 addresses the same categories as SOC 2, without the same level of detail. As a general use report, it can be freely distributed, including on the company website. It shows that the examination exists, but it lacks the tests and results a vendor assessment needs.

Which to request or produce

The vendor's service feeds your financial numbers: request SOC 1 Type 2.
The vendor hosts or processes your data: request SOC 2 Type 2, with the categories tied to the service's risk.
The vendor has not completed an observation period yet: SOC 2 Type 1 may work for a while, with an agreed date to receive Type 2.
Your company sells to customers who require the report: start with a readiness assessment, then go to Type 1 or straight to Type 2.
You want to show the result to the market: SOC 3 complements SOC 2 but does not replace it in a vendor assessment.

SOC 2 is not a certificate and does not replace ISO 27001

SOC 2 has no certificate and no passing grade. An independent auditor issues an opinion on the described controls, and the report may record exceptions. ISO 27001, in contrast, certifies an information security management system. The two share controls but answer different questions: ISO shows that the management system was audited; SOC 2 Type 2 shows how specific controls operated over a period.

The examination is performed by certified public accountants (CPAs). Before hiring a firm, confirm that it is qualified to issue this type of report.

How to read a vendor's SOC 2

Receiving the PDF does not end the assessment. Check these points:

Scope: is the system described the one you are buying?
Type and period: is it Type 2? Is the period recent?
Categories: do they cover the service's risk? A critical service without Availability deserves a question.
Auditor's opinion: is it qualified?
Exceptions: what failed in testing, what was the impact and what did management do about it?
Customer controls: which complementary controls are your responsibility?
Subservice providers: are the cloud and other third parties included in or carved out of scope?
Date gap: if the period ended months ago, ask for a bridge letter, keeping in mind that it is a management statement, not an auditor's opinion.

This reading also matters in regulated sectors. For cloud services contracted by Brazilian financial institutions, access to independent audit reports is part of what regulation asks for.

What is coming in 2027

In October 2026, the AICPA's assurance committee published exposure drafts revising the Trust Services Criteria and the SOC 2 description criteria, with the stated goal of improving relevance, clarity and usability. They are proposals, and the official page does not give an effective date. If your examination is being planned now, ask the auditor which version will apply.

Where Network Secure comes in

Network Secure does not issue SOC 1, SOC 2 or SOC 3 reports: that is the role of an independent auditor. Our work comes before and alongside it. On the GRC front, we support the organization of controls, policies and evidence. The Eagle platform from Futture AI maps controls to frameworks such as ISO 27001 and SOC 2, reusing a single inventory. And the 24×7 SOC generates monitoring and response records that can form part of the evidence; the auditor decides whether they are sufficient.

Frequently asked questions

What is a SOC report?

It is an independent audit report on an organization's controls, issued under AICPA standards. Here, SOC stands for System and Organization Controls, not Security Operations Center.

What is the difference between SOC 1 and SOC 2?

SOC 1 addresses controls that affect customers' financial reporting. SOC 2 addresses security, availability, processing integrity, confidentiality and privacy.

What is the difference between SOC 2 Type 1 and Type 2?

Type 1 assesses the design of controls on a specific date. Type 2 also assesses whether they worked over a period, usually three to twelve months.

Does SOC 3 replace SOC 2?

No. SOC 3 covers the same categories in less detail and can be freely distributed. To assess a vendor, SOC 2 provides the tests and results you need.

Is SOC 2 a certification?

No. The result is a report with an independent auditor's opinion, which may record exceptions. There is no certificate or passing grade.

Sources consulted through October 30, 2026: AICPA & CIMA pages on SOC 1, SOC 2 and SOC 3 and the exposure drafts of the proposed 2027 criteria; article published by the Cloud Security Alliance on the Type 2 period. This article is for information only and does not replace guidance from the auditor responsible for the examination.