SOC 3 — System and Organization Controls Public Assurance Report
- ClassificationCategoryCompliance / Assurance StandardDomainIT GovernanceFramework FamilySOC Frameworks
- Regulatory ContextTypeCertification / Assurance ProgramLegal InstrumentAttestation StandardSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionNorth AmericaRegion DetailUnited States (used internationally)PublisherAmerican Institute of Certified Public Accountants (AICPA): Trust Services Criteria by its Assurance Services Executive Committee, attestation standards by its Auditing Standards Board
- VersioningVersionGeneral-use report prepared from an AT-C 105 and 205 examination against the 2017 Trust Services Criteria with revised points of focus 2022 (TSP section 100); guidance in the AICPA SOC 2 Guide updated October 15, 2022Effective DateMay 1, 2017 (AT-C sections 105 and 205 under SSAE No. 18, for practitioners' reports dated on or after)Issue Date2017 (Trust Services Criteria); points of focus revised 2022; SOC 2 Guide covering SOC 3 reports October 15, 2022
- AdoptionAdoption ModelVoluntaryImplementation ComplexityMedium
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Partial
The 2017 Trust Services Criteria are a free AICPA download with a free account; AT-C sections 105 and 205 and the AICPA SOC 2 Guide that covers SOC 3 reporting are AICPA publications sold through the AICPA and CIMA store. A service organization's own SOC 3 report is published by that organization.
Framework text is licensed by its publisher and is included only where stated above.
- SOC 3 is the AICPA's general-use report on a service organization's controls against the Trust Services Criteria.
- It addresses the same controls as SOC 2 but without the detailed description, tests, and results, so it can be freely distributed.
- It is prepared from the same examination under AT-C sections 105 and 205; no second examination is needed.
- A reader gets the auditor's opinion, management's assertion, and a short description of the system boundaries.
- SmartSuite Compliance Management runs the single control set and examination period that yield both the SOC 2 and the SOC 3 report.
Overview
SOC 3 (SOC for Service Organizations: Trust Services Criteria for General Use Report) is the AICPA's general-use report on a service organization's controls relevant to security, availability, processing integrity, confidentiality or privacy. In the AICPA's words, SOC 3 reports address the same controls as SOC 2 but do not provide the same level of detail, so they are considered general use reports and can be freely distributed. A service organization posts it on its website or hands it to prospects who have no contractual right to the full SOC 2 report.
The AICPA publishes the criteria and the guidance. A SOC 3 report is prepared from an examination performed under AT-C sections 105 and 205 of the attestation standards against the 2017 Trust Services Criteria (TSP section 100, with revised points of focus issued in 2022), the same criteria used for SOC 2. The AICPA's SOC 2 guide, updated as of October 15, 2022, includes the guidance for preparing and issuing a SOC 3 report, and the AICPA lists SOC 3 as one of the engagements in its SOC suite alongside SOC 1, SOC 2, SOC for Cybersecurity and SOC for Supply Chain.
What a reader gets is the service auditor's opinion and management's assertion that the controls were effective to provide reasonable assurance of achieving the entity's objectives based on the applicable Trust Services Criteria, with a short description of the system boundaries, and what the reader does not get is the detailed system description, the list of controls, the tests the auditor performed and their results. That trade is the point: a SOC 3 report tells the market that an independent CPA examined the system; the SOC 2 report tells a customer's risk team what was examined and what was found.
Why does it matter?
Most service organizations cannot hand their SOC 2 report to every prospect, partner and journalist who asks, because it contains the detailed description of controls and the auditor's test results. SOC 3 solves the distribution problem without a second examination: the same engagement under AT-C 105 and 205 against the same Trust Services Criteria yields a report the AICPA treats as general use and freely distributable. For a buyer at the first screening stage, a current SOC 3 report answers whether an independent CPA has examined the provider's controls and for which categories, before any contract or non-disclosure agreement is in place.
Key benefits include:
- Freely distributable
The AICPA states that SOC 3 reports are considered general use reports and can be freely distributed, so a provider can publish one on its trust page.
- Same criteria as SOC 2
The opinion is based on the 2017 Trust Services Criteria (TSP section 100), so the categories a reader sees in a SOC 3 report are the categories examined in the underlying engagement.
- Opinion without the detail
The report carries the auditor's opinion and management's assertion but not the detailed description of controls, tests or results that a SOC 2 report contains.
- One examination, two reports
The AICPA's SOC 2 guide includes the guidance for preparing and issuing a SOC 3 report, so the SOC 3 is produced from the SOC 2 engagement rather than a separate audit.
- A screening tool for buyers
A SOC 3 report tells a prospect that an independent CPA examined the system and which categories were covered, before the full SOC 2 report is shared under contract.
How does it work?
The engagement behind a SOC 3 report is the AT-C 205 examination described in the AICPA's SOC 2 guide: the service auditor obtains management's written assertion, evaluates whether the controls were suitably designed and operated effectively to provide reasonable assurance of achieving the entity's objectives based on the applicable Trust Services Criteria, and forms an opinion. The categories in scope are chosen by the service organization from security, availability, processing integrity, confidentiality and privacy, with security as the common criteria set.
From that engagement the auditor issues two reports. The SOC 2 report contains the full system description prepared under DC section 200, the controls, the tests and their results and is intended for the service organization's customers and their auditors. The SOC 3 report contains the auditor's opinion, management's assertion and a brief description of the system boundaries and the categories examined, and omits the description of tests and results; because it omits that detail, the AICPA classifies it as a general-use report that may be distributed without restriction.
A reader of a SOC 3 report should look for four things: the name of the CPA firm that signed the opinion, the categories covered, the period or date the opinion refers to, and whether the opinion is unmodified. Anything more, such as which controls address which criteria, which subservice organizations are carved out and what the auditor's tests found, is in the SOC 2 report and must be requested from the service organization. The AICPA's notice on its SOC pages, that it is examining allegations about a compliance vendor's SOC business practices, is a reminder to check that the signing firm is a licensed CPA firm enrolled in peer review.
Key Elements
- Service auditor's opinion
The CPA's opinion, under AT-C 105 and 205, on whether the controls were effective to provide reasonable assurance of achieving the entity's objectives based on the applicable Trust Services Criteria.
- Management's assertion
The service organization's written statement about the effectiveness of its controls for the categories and period covered.
- Categories covered
Which of security, availability, processing integrity, confidentiality and privacy were in the examination; security is always included.
- Period or date
The examination period, or the as-of date, that the opinion refers to, which tells a reader how current the assurance is.
- System boundaries
A brief description of the system and its boundaries, without the detailed description, control list, tests or results found in the SOC 2 report.
- General-use status
The report carries no restriction on distribution, which is what distinguishes it from a SOC 2 report.
What does it cover?
SOC 3 applies to any service organization that has completed a SOC 2 examination and wants to communicate the result beyond its customers: cloud and software providers that publish assurance on a public trust page, processors that answer high volumes of inbound security questionnaires, and providers selling to buyers who cannot sign a non-disclosure agreement at the screening stage. It covers only the categories and period of the underlying examination; it cannot be used to claim coverage of categories that were not examined, and it does not replace the SOC 2 report where a customer's contract, auditor or regulator requires the detailed report.
What are its objectives?
The report exists to let a service organization share the conclusion of a Trust Services Criteria examination with anyone. In practice it aims to:
Communicate the auditor's opinion and management's assertion without restricting who may read them.
Identify the categories examined and the period covered so that readers can judge relevance and currency.
Protect the detailed control information that remains in the SOC 2 report.
Give buyers a first-screen answer before contract terms and non-disclosure agreements are agreed.
Reduce repeated questionnaire traffic by publishing one independent conclusion.
Framework in Context
SOC 3 is the third member of the AICPA's SOC for Service Organizations family: SOC 1 covers controls relevant to user entities' financial reporting under AT-C 320, SOC 2 covers the Trust Services Criteria in detail, and SOC 3 publishes the SOC 2 conclusion for general use. Because it rests on the same criteria, a SOC 3 report is read alongside ISO/IEC 27001 certificates and CSA STAR entries on a provider's trust page, but unlike a certificate it is an attestation report for a stated period and must be renewed by a new examination. Vendor risk programs that accept SOC 3 at the screening stage still ask for the SOC 2 report before relying on the provider's controls.
Common Framework Mappings
Organizations map the Trust Services Criteria behind a SOC 3 report to the frameworks below so that the public report and the detailed SOC 2 report rest on one control set and evidence library.
Mapped frameworks include:
SOC 2 (AICPA TSC 2017)
COBIT 2019
ISO 27001:2022
NIST CSF 2.0
NIST 800-53 Rev.5
SOC 1
SOC 2
SOC for Cybersecurity
How SmartSuite Supports SOC 3
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Compliance Management to run the single Trust Services Criteria control set, evidence and examination period that yield both the SOC 2 and the SOC 3 report, and Third Party Risk Management to log the SOC 3 reports you receive from your own vendors, with the categories, period and signing firm captured as fields.
One Control Set, Two Reports
Hold the Trust Services Criteria controls, owners and evidence once in Compliance Management so the SOC 2 examination and the SOC 3 report draw on the same records.
Scope and Period Record
Record the categories in scope, the examination period and the signing CPA firm for each report cycle, so the published SOC 3 always matches the examined scope.
Public Assurance Register
Track which assurance documents are approved for general distribution, their issue dates and where they are published, with review dates before each period ends.
Vendor SOC 3 Intake
Log SOC 3 reports received from vendors in Third Party Risk Management with categories, period, opinion type and the follow-up request for the SOC 2 report where reliance is needed.
Questionnaire Deflection
Link inbound security questionnaire questions to the published SOC 3 report and the criteria it covers, and track which answers still require the SOC 2 detail.
Renewal Calendar
Schedule the next examination and the SOC 3 reissue before the current period lapses, and report assurance currency on Enterprise Reporting dashboards.
Related frameworks
The AICPA Trust Services Criteria (TSP Section 100) are the control criteria a CPA uses to examine security, availability, processing integrity, confidentiality and privacy.
COBIT 2019 is ISACA's framework for governing and managing enterprise IT, with 40 objectives in five domains, six governance principles and 11 design factors.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
NIST CSF 2.0 (CSWP 29, February 26, 2024) is the voluntary cybersecurity framework with six Functions including Govern, 22 Categories, 106 Subcategories, Profiles and Tiers.
NIST SP 800-53 Rev. 5 is the NIST catalog of security and privacy controls in 20 families, mandatory for federal systems under OMB A-130 and FISMA; Release 5.2.0 issued August 27, 2025.
Frequently Asked Questions For SOC 3 (System and Organization Controls Public Assurance Report)
It is the AICPA's general-use report on a service organization's controls relevant to security, availability, processing integrity, confidentiality or privacy. The AICPA states that, like SOC 2, SOC 3 reports address those controls but do not provide the same level of detail, so they are considered general use reports and can be freely distributed. The report carries the service auditor's opinion and management's assertion.
Both come from the same examination under AT-C sections 105 and 205 against the 2017 Trust Services Criteria. The SOC 2 report includes the detailed system description under DC section 200, the controls, the auditor's tests and their results, and is meant for customers and their auditors. The SOC 3 report omits that detail and keeps the opinion, the assertion, the categories covered and the period, which is why it can be published.
A SOC 3 report suits prospects, partners and anyone screening a provider before a contract or non-disclosure agreement exists. A customer's risk, audit or compliance team that must rely on specific controls, understand carved-out subservice organizations or read the auditor's test results needs the SOC 2 report, which the service organization shares under its own terms.
No. A SOC 3 report is an attestation report containing an independent CPA's opinion for a stated period or date under AT-C 105 and 205; there is no certificate and the assurance lapses unless a new examination is performed. The correct wording is a SOC 3 report, and a reader should check the signing firm, the categories covered and the period before relying on it.
No. The AICPA's SOC 2 guide, updated as of October 15, 2022, includes the guidance for preparing and issuing a SOC 3 report from the same engagement, so a service organization that completes a SOC 2 examination can have its auditor issue both reports for the same categories and period. A SOC 3 report cannot cover categories that were not part of that examination.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.