SOC 1, 2, and 3 Reports (SSAE18)

System and Organizational Controls (SOC) reports are designed to help service organizations, organizations that operate information systems and services to other companies, build trust and confidence in their service delivery processes and controls through a report by an independent Certified Public Accountant.

There are three types of reports to support service organizations:

SOC 1 Report

These reports are specifically intended to meet the needs of companies that use service providers and the customer’s financial auditors.  Using this report it is possible to evaluate the effect of the controls at the service organization on the customers’ financial statements. User auditors use these reports to plan and perform audits of the customers’ financial statements.  Use of these reports is restricted to the management of the service organization, user entities, and user auditors. 

SOC 2 Report

These reports are intended to meet the needs of a broad range of users that need information and assurance about the controls at a service organization that affect the security, processing integrity, confidentiality, or privacy of the data center’s system and information security,  Examples of stakeholders who may need these reports are vendor management, security managers, privacy officers, regulators, and others who have an understanding of the service organization and its controls.  These reports can play an important role in:

• Oversight of the organization
• Vendor management programs
• Internal corporate governance and risk management processes
• Regulatory oversight

SOC 3 Report

These reports are intended primarily as marketing tools.  They are designed to meet the needs of users who need assurance about the controls at a service provider but who do not need the details of an SOC 1 or SOC 2 Report.  

Unlike a SOC 1 and SOC 2 reports, which are considered restricted use reports, SOC 3 Reports will enable the service provider organization to share a general use report that would be relevant to current and prospective customers as a marketing tool to demonstrate that they have appropriate controls in place to mitigate risks related to security, privacy, etc.