# SOC reports, plainly

What SOC 1, 2 and 3 actually are, and what the words around them mean.

Source: https://intransic.com/questions/soc-basics

## Is SOC 2 a certification?

No, and the difference matters more than it sounds. SOC 2 is an attestation. A licensed CPA firm examines your controls under the AICPA's attestation standards and issues a report carrying an opinion. Nobody awards you a certificate. There is no register your name appears on. What you hand a customer is the report. The AICPA's own journal notes that compliance is a term never used in SOC 2 examinations. ISO/IEC 27001 is the certification here: accredited body, certificate, expiry date. If your customer asked for a certificate, ask which they meant.

Sources:
- [System and Organization Controls: SOC Suite of Services](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) — AICPA & CIMA, read 2026-09-05
- [Promises of 'fast and easy' threaten SOC credibility](https://www.journalofaccountancy.com/issues/2026/feb/promises-of-fast-and-easy-threaten-soc-credibility/) — Journal of Accountancy, read 2026-09-05
- [ISO/IEC 27001:2022 — Information security management systems — Requirements](https://www.iso.org/standard/27001) — ISO, read 2026-09-05

## What is SOC 1 and do I need one?

You need one if your service affects your customers' financial reporting. SOC 1 covers internal control over financial reporting. SOC 2 covers security and the other trust services criteria. A payroll processor or a billing platform gets asked for SOC 1. A product that stores data but never touches the numbers in an audited statement does not. Some companies are asked for both, and they are separate engagements with separate reports. If a customer asks for SOC 1, ask which of your services they think affects their financials. The answer is occasionally that they meant SOC 2.

Sources:
- [System and Organization Controls: SOC Suite of Services](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) — AICPA & CIMA, read 2026-09-05
- [Promises of 'fast and easy' threaten SOC credibility](https://www.journalofaccountancy.com/issues/2026/feb/promises-of-fast-and-easy-threaten-soc-credibility/) — Journal of Accountancy, read 2026-09-05

## What is SOC 3 and should I publish one?

SOC 3 is the version you may put on your website. A SOC 2 report is restricted to specified parties, so you cannot publish it and you should be wary of anyone who does. SOC 3 covers the same examination and strips the detail: management's assertion, the boundaries of the system, your service commitments, and the auditor's report. No control descriptions and no test results. That makes it useful as a public signal and useless as diligence. Publish one if you want something linkable. Expect a serious reviewer to ask for the SOC 2 anyway.

Sources:
- [Illustrative SOC 3 Report](https://www.aicpa-cima.com/resources/download/illustrative-soc-3-r-report) — AICPA & CIMA, read 2026-09-05
- [Promises of 'fast and easy' threaten SOC credibility](https://www.journalofaccountancy.com/issues/2026/feb/promises-of-fast-and-easy-threaten-soc-credibility/) — Journal of Accountancy, read 2026-09-05
- [FAQs for SOC 2 and SOC 3 examinations](https://www.aicpa-cima.com/resources/article/read-the-latest-faqs-for-soc-2-r-and-soc-3-r-examinations) — AICPA & CIMA, read 2026-09-05

## What is a service organization, and am I one?

You are one if another company relies on your controls to run their own. That is the whole test. Your customer has outsourced a function to you. Storing their data. Processing their transactions. Running part of their operation. Their auditors and their risk team now care how you run it, because your weaknesses land in their environment. Being a service organization is not a status you apply for. It describes your position in somebody else's supply chain, and it is why they ask.

Sources:
- [System and Organization Controls: SOC Suite of Services](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) — AICPA & CIMA, read 2026-09-05
- [What service organization management needs to know about SOC 2](https://www.aicpa-cima.com/resources/download/see-what-service-organization-management-needs-to-know-about-soc-2-r) — AICPA & CIMA, read 2026-09-05

## What is SOC for Cybersecurity and is it what I need?

It is a different examination, and it is seldom what your customer means. The AICPA introduced SOC for Cybersecurity in 2017, for organizations wanting to communicate about their cybersecurity risk management programme as a whole. SOC 2 examines controls over a defined system against named trust services criteria. The audiences differ. One speaks to a board, the other to a customer doing vendor diligence. When your procurement contact asks for a SOC report, they mean SOC 2. Offering the other reads as a substitution.

Sources:
- [SOC 2 examinations and SOC for Cybersecurity examinations: Understanding the Key Distinctions](https://www.aicpa-cima.com/resources/download/learn-about-the-key-distinctions-between-a-soc-2-examination-and-a-soc-for-cybersecurity-examination) — AICPA & CIMA, read 2026-09-05
- [System and Organization Controls: SOC Suite of Services](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) — AICPA & CIMA, read 2026-09-05

## Everyone says they are compliant. What does that word mean here?

In a SOC 2 context, nothing. The AICPA's own journal notes that compliance is a term never used in SOC 2 examinations, and that vendors promise it anyway. What exists is an examination, an opinion, and a report covering a defined system for a defined period. Compliant is a word from another vocabulary, attached to this one by marketing. This matters past pedantry. Write it about yourself and a reader who knows the field learns something about how carefully you write. It is not what you intended.

Sources:
- [Promises of 'fast and easy' threaten SOC credibility](https://www.journalofaccountancy.com/issues/2026/feb/promises-of-fast-and-easy-threaten-soc-credibility/) — Journal of Accountancy, read 2026-09-05
- [System and Organization Controls: SOC Suite of Services](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) — AICPA & CIMA, read 2026-09-05
- [2017 Trust Services Criteria (With Revised Points of Focus – 2022)](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022) — AICPA & CIMA, read 2026-09-05