--- title: "SOC 1, SOC 2, and SOC 3 Are Three Answers to Three Different Questions" description: "A story plays out on r/soc2 every few weeks. A company has been handing every prospect a SOC 2 report, things are going fine, and then a customer's finance team comes back asking specifically for a SOC 1. Panic spreads" url: https://kaynemcgladrey.com/blog/soc-1-soc-2-and-soc-3-are-three-answers-to-three-different-questions/ date: 2026-10-21 modified: 2026-10-21 author: "Kayne" image: https://kaynemcgladrey.com/wp-content/uploads/2026/10/sock-1-sock-2-and-sock-3.webp categories: ["Blog"] type: post lang: en-US --- # SOC 1, SOC 2, and SOC 3 Are Three Answers to Three Different Questions A story plays out on r/soc2 every few weeks. A company has been handing every prospect a SOC 2 report, things are going fine, and then a customer’s finance team comes back asking specifically for a SOC 1. Panic spreads through the company’s Slack channels, followed by a post asking what the difference even is. The confusion is almost entirely the numbering’s fault. SOC stands for System and Organization Controls, and the 1, 2, and 3 sound like levels in a video game or tiers of a subscription plan. Nearly every comparison guide on the internet spends its first paragraph correcting that, before quietly rebuilding it with a feature matrix or a checklist. The numbers aren’t progressions. They’re three different audit products, built for three different audiences, that answer three different questions about your company. So the real question isn’t which SOC report is best. It’s who on the customer’s side is doing the asking. ## Three Reports, Three Audiences, No Sequence Nobody “graduates” from SOC 1 to SOC 2. Plenty of companies hold a SOC 2 and will never need a SOC 1, while a payroll processor with a SOC 1 may never be asked for anything else. Treating the reports as a maturity path is the single most expensive misunderstanding in this space, and it’s baked right into how people talk about them. | Report | Primary audience | What it attests to | Distribution | | --- | --- | --- | --- | | SOC 1 | Customer’s external financial auditors | Controls affecting customer financial reporting | Restricted, under NDA | | SOC 2 | Customer’s security, risk, and procurement teams | Trust Services Criteria controls | Restricted, under NDA | | SOC 3 | The general public and early-stage prospects | Summary of SOC 2 results only | Public, no NDA | A few other myths are worth clearing up. - These reports aren’t certifications, no matter how many vendors’ marketing pages say “SOC 2 certified.” They’re attestations performed by a certified public accountant (CPA) firm under [SSAE 18](https://www.aicpa-cima.com/resources/download/aicpa-statement-on-standards-for-attestation-engagements-no-18), the AICPA’s Statement on Standards for Attestation Engagements, which is a different legal instrument entirely. - SOC 3 doesn’t replace SOC 2 for reasons covered below. - SOC 1 isn’t a security report at all, and buyers who ask for one expecting firewall details are asking the wrong question. ## SOC 1 Exists for Your Customer’s Accountant Picture a payroll processor with thousands of clients. Its outputs land directly in each client’s financial statements, and if the [SOC suite of reports](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) didn’t exist, every one of those clients’ external auditors would need to independently examine the processor’s controls every single year. SOC 1 consolidates that work into one audit the auditor can rely on, which explains why the report exists and who actually reads it. The audience is what companies get wrong. When a customer asks for a SOC 1, the request usually originated with their controller or their external audit firm, not their security team. Payroll is the archetype, but the same logic covers payment processors, claims administrators, loan servicers, and benefits platforms. If your output becomes a line on someone else’s books, their auditor eventually comes asking. ### The Fine Print That Vendors Rarely Explain Complementary User Entity Controls (CUECs) define which controls the customer has to operate on their end. A payroll SOC 1 will assert that the vendor calculates taxes correctly, while the customer remains responsible for reviewing and approving the payroll register before submission. Agree on those boundaries with the customer early, because fighting over them after fieldwork starts is miserable. Two other practical details shape how the engagement runs. - Companies frequently align the audit period to the customer’s fiscal year, say October through September, so the report covers most of their year and arrives before their own audit season. - Many CPA firms will run combined SOC 1 and SOC 2 engagements from a single audit window, testing the shared IT controls once and issuing two reports. If you need both, that’s the cheap way to do it. ## SOC 2 Is What the B2B Market Demands, Not What the Law Requires No statute requires SOC 2. HIPAA doesn’t mention it, and neither does PCI DSS. Enterprise procurement teams demand it anyway, which turns a voluntary attestation into a de facto entry requirement for selling software to anyone with a security team. The bigger the client, the more likely the request arrives before signature. The report tests controls against the [Trust Services Criteria](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022), established in 2017 by the Assurance Services Executive Committee of the American Institute of Certified Public Accountants (AICPA) and revised in 2022 to modernize the points of focus for cloud environments. - **Security** is the only mandatory category. - **Availability, Processing Integrity, Confidentiality, and Privacy** are scoped in as needed. The common practitioner advice is to add Availability and Confidentiality because they barely move the audit cost, while Privacy only earns its keep if you’re handling regulated personal data. SOC 2 dominates technology vendor programs because a single audit is supposed to replace an endless queue of one-off security questionnaires, and buyers noticed. (It also tends to leave you with better access management and incident response than you started with.) However, not all buyers will accept just a SOC2, and so you might see additional questions. ## SOC 3 Is a Summary You Can Hand Out Without an NDA SOC 3 cannot be issued without a completed SOC 2 Type II carrying an unqualified opinion, meaning the auditor concluded your controls were suitably designed and operating effectively overall, and a qualified opinion rules it out. > SOC 3 is a marketing surface for a SOC 2 you already paid for. What you get is a short public document, roughly ten pages, that you can distribute without a nondisclosure agreement (NDA) and that summarizes results in pass/fail terms with none of the test detail. While a SOC 2 might name your specific firewall vendor, the SOC 3 confirms that one is installed and operating. Whether that trade is worth making is contested. Published estimates for the SOC 3 add-on range from about $1,000 to $8,000 on top of the SOC 2 engagement, and commenters in the r/soc2 community question whether a publicly available security whitepaper achieves the same effect for free. Adoption remains low, partly because awareness of the option is limited. The defensible position is that SOC 3 earns its fee only when NDA friction is slowing your pipeline, when a prospect’s junior buyer wants something they can forward around internally without a legal review. ## Type I Versus Type II Is the Decision People Miss A customer asking for SOC 1 and a customer asking for SOC 2 Type I want completely different documents, and the two requests get collapsed into one constantly. | | Type I | Type II | | --- | --- | --- | | Question answered | Were controls suitably designed? | Did controls operate effectively? | | Evidence window | A point in time | 3 to 12 months | | How buyers see it | Better than nothing | The floor for banks and regulated buyers | | Best use | A bridge while the observation window runs | The report procurement actually accepts | Sophisticated buyers will reject a short observation window as insufficient evidence, so the window length is itself a scoping decision. Most first-time vendors skip the bridge and go straight to Type II, though Type I remains the answer when an enterprise deal needs something now and the full report lands in eight months. One distinction worth knowing cold. An **exception** means **one** control failed its sample, while a **qualification** means **an entire criterion** failed. Minor exceptions appear in plenty of perfectly usable reports with unqualified opinions, but **qualifications** stall enterprise procurement and put SOC 3 off the table until they’re resolved. ## What Each Choice Costs You Every cost figure in this space comes with an asterisk, because scope, firm tier, and readiness move the numbers enormously. The envelope runs from about $5,000 for a narrow first engagement to $150,000 for a large, complex one, with SOC 2 Type II auditor fees commonly landing between $20,000 and $50,000. Big Four quotes naturally skew high. Tooling, penetration testing, and consultant time stack on top. What tends to get ignored or forgotten is the recurring nature of the commitment. Reports age out after roughly twelve months, renewals run faster and cheaper than the first audit, and back-to-back observation windows prevent coverage gaps that buyers will notice. Maintaining SOC 2 is an ongoing operational commitment, and the work doesn’t stop when the report is issued. - Quarterly access reviews - Continuous evidence collection against each control - Annual policy refreshes and vendor reviews - Periodic backup and disaster recovery testing Year two costs less than year one, but it’s not free. If you need both SOC 1 and SOC 2, the combined engagement is the budget play. Access management, change management, monitoring, and vendor oversight overlap heavily across the two frameworks, and testing them once cuts meaningful spend. ## How to Choose - Does your service output land in your customer’s financial statements? SOC 1. - Do you hold or process customer data? SOC 2, and realistically SOC 2 Type II. - Has NDA friction visibly slowed deals? SOC 3 on top of an existing SOC 2. - Is the ask coming from a bank or a regulated buyer? Expect to provide both reports, with Type II observation windows. Payroll SaaS companies routinely carry a SOC 1 for the financial workflow and a SOC 2 for the Social Security numbers and bank details they store, and that pairing is common enough to be its own category. ## Back to That Customer Who Asked for SOC 1 The company in the Reddit thread hadn’t done anything wrong by leading with SOC 2. Their customer simply wasn’t asking for a better version of it, because the finance team and the security team at the same client can legitimately want different documents. They’re asking different questions about what your company does with their money and their data respectively. Before you commit to an auditor, take one last practical step and verify the firm is enrolled in the [AICPA Peer Review Program](https://peerreview.aicpa.org/). Enrollment is what qualifies a CPA firm to issue these reports credibly, and the public file search makes checking a thirty-second job. If a prospect asks which SOC report you have, the answer starts with figuring out who at their company is doing the asking.