Print / Save PDF

SOC 1 / SOC 2 / SOC 3

• SOC 1: “an examination of controls at a service organization that are likely to be relevant to user entities' internal control over financial reporting.” [1]
• SOC 2: examination of controls “relevant to one or more of the trust services criteria over security, availability, processing integrity, confidentiality, or privacy” (AICPA TSC ¶.11). [3]
• SOC 3: “Like SOC 2, SOC 3 reports address controls relevant to security, availability, processing integrity, confidential and privacy. However, they do not provide the same level of detail. Therefore, they are considered general use reports and can be freely distributed.” A SOC 3 report “contains an opinion on the operating effectiveness of controls but does not include a detailed description of tests” (TSC ¶.11). [2] [3]

Related hubs: SOC 2 · location pages such as SOC 2 auditors in the United States.

Type 1 vs Type 2

TSC ¶.11: Type 2 = suitability of design and operating effectiveness “throughout a specified period”, and includes the auditor's tests and results. Type 1 “addresses the same subject matter… however… does not contain an opinion on the operating effectiveness of controls nor a detailed description of tests”. Use “design only, no operating-effectiveness opinion” for Type 1 — the phrase “point in time” does not appear in the AICPA text fetched for this page. Vigil Assurance’s own page says Type I is “as of a point in time”; that phrase is the firm’s. [3] [16]

Observation period

AICPA language is “throughout a specified period”. No AICPA statement on a minimum length was found in the sources checked on 20 Oct 2026. This page does not claim a minimum, or that none exists. A firm-published example is “typically three to twelve months” (Vigil Assurance). [3] [16]

Do I need a pentest first?

CC4.1 (COSO Principle 16) has an additional point of focus: “Management uses a variety of different types of ongoing and separate evaluations, including penetration testing, independent certification made against established specifications (for example, ISO certifications), and internal audit assessments.” TSC ¶.04 says: “Use of the trust services criteria does not require an assessment of whether each point of focus is addressed.”

The TSC lists penetration testing as one example of the evaluations under CC4.1. Points of focus are not individually required. Ask your auditor how they will evaluate CC4.1. Cited as the 2020 TSC (March 2020 version). The current 2022 revised version is behind a free AICPA login and was not checked on 20 Oct 2026. [3]

Related: agentic pentesting comparison (verified listings, not a requirement).

Readiness assessment vs audit, and independence

AICPA’s Journal of Accountancy (May 2026): “CPAs must remain competent, objective, independent.” The AICPA Peer Review Board flags as “nonconforming” any SOC 2 engagements with “identical reports, risk assessments, sample sizes, and testing procedures”. [4]

AICPA Ethics Staff Insights (13 Apr 2026): business arrangements with SOC 2 tool providers “can raise significant threats to compliance with the Code of Professional Conduct”. [5]

The AICPA Code text on nonattest services for attest clients was not fetched for this update, so this page does not say that an auditor cannot do readiness work.

Also see the SOC 2 automation tool buyer’s guide for 2026 red flags on bundled examinations.

How to choose and verify an auditor

Buyer checklist (AICPA Journal of Accountancy, Feb 2026)

Before engaging a firm, that article says clients should:

• “Vet the CPA firm… including its size, capacity, and client references”
• “Evaluate the firm's qualifications, experience, and peer review results”
• “Ask about the scope of the examination, the sampling procedures… and how the firm maintains its independence”
• “Assess the offering. Is it unrealistically fast, easy, or cheap?”

The same article says SOC reports “are examinations performed by CPAs in accordance with the AICPA's Statements on Standards for Attestation Engagements”. [6] This is not a ranking.

Verify a CPA (SOC auditor)

NASBA says “CPAverify.org is a CPA license search tool populated by official, publicly available, CPA licensing data sent from Boards of Accountancy… With 53 jurisdictions participating… the only official, free, single-source national database of licensed CPAs.” cpaverify.org now redirects to the Accountancy Licensing Database. [7] [8]

Agent Index listings: auditors hub · SOC 2 in the US · UK · India · Germany · Netherlands · Japan · Australia · Canada · Ireland.

Verify an ISO 27001 certificate or certification body

ISO’s guidance: “Check if it is accredited… However, accreditation is not compulsory, and non-accreditation does not necessarily mean the certification body is not reputable.” To verify, “Use the International Accreditation Forum's global database, IAF CertSearch… Certificates can be verified individually, in bulk, or via API; or contact the relevant certification body, accreditation body, or Global ACI directly.” [9]

ISO does not certify: “ISO does not perform certification or issue certificates.” Certificates should cite the full reference, e.g. “certified to ISO/IEC 27001:2022”. [10]

IAF ceased operations on 01 January 2026. Global ACI has assumed the former roles of the International Accreditation Forum (IAF) and the International Laboratory Accreditation Cooperation (ILAC). When describing signatories, say Global ACI MRA signatories (formerly IAF MLA) rather than “IAF member accreditation bodies”. ISO.org still points to IAF CertSearch; this page links only the CertSearch homepage (its /about and /faq returned 404 on 20 Oct 2026). [11] [12] [13]

ANAB (US) accredits ISO/IEC 27001 certification bodies against ISO/IEC 17021-1 and ISO/IEC 27006 (ANAB AR 28). UKAS and NABCB pages were not confirmed for an ISMS statement on 20 Oct 2026. [14] Related: ISO 27001 hub · ISO 27001 auditors in the US (where published).

FAQ

What is the difference between SOC 1, SOC 2 and SOC 3?

SOC 1 examines controls likely relevant to user entities’ internal control over financial reporting. SOC 2 examines controls relevant to one or more of the trust services criteria (security, availability, processing integrity, confidentiality or privacy). SOC 3 addresses the same criteria as SOC 2 but without the same level of detail, so it is a general-use report that can be freely distributed.

What is Type 1 vs Type 2?

Per AICPA TSC ¶.11, Type 2 covers suitability of design and operating effectiveness throughout a specified period, and includes the auditor’s tests and results. Type 1 addresses the same subject matter but does not contain an opinion on the operating effectiveness of controls nor a detailed description of tests. The phrase “point in time” does not appear in the AICPA text fetched for this page; one firm (Vigil Assurance) uses “as of a point in time” on its own site.

How long is the SOC 2 observation period?

AICPA language is “throughout a specified period”. No AICPA statement on a minimum length was found in the sources checked on 20 Oct 2026. We do not claim a minimum, or that none exists. A firm-published example is “typically three to twelve months” (Vigil Assurance).

Do I need a pentest before a SOC 2?

CC4.1 lists penetration testing as one example of the evaluations under that criterion. Points of focus are not individually required. Ask your auditor how they will evaluate CC4.1. Cited from the 2020 TSC (March 2020 update); the 2022 revision was behind a login and was not checked for this page.

Can my auditor also do readiness work?

AICPA materials from 2026 stress competence, objectivity and independence, and flag identical SOC 2 engagements as nonconforming. Ethics staff warn that business arrangements with SOC 2 tool providers can raise significant threats to the Code of Professional Conduct. The AICPA Code text on nonattest services for attest clients was not fetched for this page, so we do not state that an auditor cannot do readiness work.

How do I verify a CPA firm or an ISO 27001 certificate?

For CPAs, NASBA’s CPAverify (now the Accountancy Licensing Database) is described as the official free national database of licensed CPAs, with 53 jurisdictions participating. For ISO certificates, ISO says to check whether the certification body is accredited — accreditation is not compulsory — and points to IAF CertSearch. IAF ceased operations on 1 January 2026; Global ACI has assumed the former IAF and ILAC roles. ISO.org still points to IAF CertSearch.

Related: which framework to look into · published costs and timelines · audit-prep templates · after the audit · SOC 2 to ISO/IEC 27001 · Vanta and Drata audit partners · get matched with listed agents.

Sources

1. AICPA & CIMA — SOC 1. https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-1
2. AICPA & CIMA — SOC 3. https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-3
3. AICPA, 2017 Trust Services Criteria (March 2020 update). https://web.archive.org/web/20230905175109id_/https://us.aicpa.org/content/dam/aicpa/interestareas/frc/assuranceadvisoryservices/downloadabledocuments/trust-services-criteria-2020.pdf
4. Journal of Accountancy, May 2026 — AICPA guides peer reviewers to address SOC 2 risks. https://www.journalofaccountancy.com/issues/2026/may/aicpa-guides-peer-reviewers-to-address-soc-2-risks/
5. AICPA Ethics Staff Insights, 13 Apr 2026 — SOC tool providers. https://www.aicpa-cima.com/resources/article/esi-soc
6. Journal of Accountancy, Feb 2026 — buyer checklist and SOC as SSAE examinations. https://www.journalofaccountancy.com/issues/2026/feb/promises-of-fast-and-easy-threaten-soc-credibility/
7. NASBA — CPAverify. https://nasba.org/licensing/cpaverify/
8. NASBA Accountancy Licensing Database (CPAverify search). https://ald.nasba.org/search/cpa
9. ISO — certification. https://www.iso.org/certification.html
10. ISO — ISO/IEC 27001. https://www.iso.org/standard/27001
11. IAF — ceased operations 1 Jan 2026. https://iaf.nu/en/iaf-members/
12. Global ACI. https://globalaccreditationcooperationincorporated.org/
13. IAF CertSearch. https://www.iafcertsearch.org/
14. ANAB AR 28. https://anab.qualtraxcloud.com/ShowDocument.aspx?ID=1037
15. AICPA and AIUC joint AI assurance offering, 18 Oct 2026 (dateline 19 Oct 2026). https://www.aicpa-cima.com/news/article/auditors-meet-urgent-demand-for-ai-assurance-with-new-offering-from-aicpa-and-aiuc
16. Vigil Assurance SOC 2 page (firm-published Type I “as of a point in time”; Type II typically three to twelve months). https://www.vigilassurance.com/services/attestservices
17. Agent Index dataset v0.1.27. https://theagentindex.io/agents.json

Prepared by Agent Index (Heritage Services). Last reviewed 20 Oct 2026. General information, not legal advice. Confirm scope with your counsel or auditor. Licensed CC BY 4.0.