SOC 3

SOC 3 engagements result in Trust Services Report for Service Organization similar to that of a SOC 2 using the predefined criteria in Trust Services Principles, Criteria and Illustrations. The key difference between a SOC 2 report and a SOC 3 report is that a SOC 2 report, which is generally a restricted use report, contains a detailed description of the service auditor’s tests of controls and results of those tests as well as the service auditor’s opinion on the description of the service organization’s system. A SOC 3 report is a general-use report that provides only the auditor’s report on whether the system achieved the trust services criteria (no description of tests and results or opinion on the description of the system). It also permits the service organization to use the SOC 3 seal on its website. SOC 3 reports similar to SOC 2 reports can be issued on one or multiple Trust Services principles (security, availability, processing integrity, confidentiality and privacy).