Skip to content

SOC 3

What is SOC 3?

A publicly available summary report based on the same Trust Services Criteria as SOC 2. SOC 3 reports provide a general overview of the service organisation's controls without the detailed testing results included in SOC 2 reports.

Audit

Frameworks that govern soc 3

NIST Cybersecurity Framework 2.0View framework →CIS Controls v8View framework →

What the standards actually require on soc 3

Requirements naming soc 3 across 3 standards, quoted from the control text.

SSAE 18 - Attestation Standards (SOC Reporting)1 control

SOC 3 reports provide an examination opinion on controls relevant to the Trust Services Criteria for general distribution, without the detailed description and test results found in SOC 2.

SSAE-07 · SOC 3 General Use Reports →
AICPA SOC 35 controls

Define infrastructure, software, people, procedures, and data within the SOC 3 reporting scope.

SOC3-BOUNDARY · System Boundary →
FTC Health Breach Notification Rule1 control

HBNR crosswalk to comprehensive security + privacy + health frameworks. NIST CSF 2.0 mapping: GOVERN (privacy officer + IR + records + TPSP) + IDENTIFY (PHR identifiable info inventory + 3rd-party SDK audit + affected individual identification) + PROTECT (encr...

HBNR-Crosswalk-NIST-CSF-ISO-HIPAA · Crosswalk to NIST CSF 2.0, NIST 800-66, ISO 27001/27701, SOC 2 and HIPAA →

Questions people ask about soc 3

What is SOC 3?
A publicly available summary report based on the same Trust Services Criteria as SOC 2. SOC 3 reports provide a general overview of the service organisation's controls without the detailed testing results included in SOC 2 reports.
Why is SOC 3 important for compliance?
SOC 3 is a key concept in Audit. Understanding soc 3 helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address SOC 3?
SOC 3 appears in the requirement text of SSAE 18 - Attestation Standards (SOC Reporting), AICPA SOC 3, FTC Health Breach Notification Rule. Across these standards we have identified 7 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about SOC 3?
Explore our compliance framework pages to see how soc 3 applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how SOC 3 applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.