In short
A System and Organization Controls (SOC) 3 report covers the same trust services criteria as a SOC 2 report, but is a short, general-use report without the detailed system description or the tests performed and their results.
Key takeaways
- It can be shared freely, for example on the service organization's website.
- It is useful for marketing and reassurance, not for a user auditor's detailed reliance.
- SOC 2 reports, by contrast, are restricted to knowledgeable users.
Where it's tested
ISC: System and Organization Controls (SOC) Engagements — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
A prospective customer asks a SaaS provider for a report on its security controls that the provider can publish openly on its website. Which report is appropriate?