SOC 1, SOC 2 and SOC 3: Reading a Vendor Assurance Report Properly

A vendor hands you a SOC 2 report and the procurement process treats it as a pass. It is not a pass — it is a document describing what an auditor examined, over what period, and what they found. Reading it properly takes twenty minutes and regularly changes the decision.

The report types

SOC 1 covers controls relevant to a customer's financial reporting. Its audience is auditors, and it is the right report for a payroll processor or a service that touches your financial statements. It says little about security.

SOC 2 covers controls against the trust services criteria — the security-relevant report and the one usually meant. It is restricted-use, shared under agreement, and it contains genuine detail about controls and findings.

SOC 3 is a public summary of a SOC 2 with the detail removed. It tells you an audit happened and produced an opinion; it does not let you assess anything. A vendor offering only a SOC 3 has not given you what you need. Note also that an attestation report and a certification are different things — ISO 27001 certifies a management system, while a SOC report is an auditor’s opinion on controls, and the frameworks they sit within are compared under COBIT and IT governance.

Type I and Type II — the distinction that matters most

Type I assesses whether controls are suitably designed at a single point in time. The auditor looked at the design on one date and formed an opinion about it. Nothing is tested for whether it actually operated.

Type II assesses whether controls were suitably designed and operated effectively over a period, typically six to twelve months. The auditor sampled evidence across that period.

The gap between them is enormous. A Type I says a policy exists; a Type II says it was followed. For any vendor handling data you care about, require Type II — and check the period covered, because a report whose window ended fourteen months ago describes a company that may no longer exist in that form.

The trust services criteria

Every SOC 2 covers Security, which is mandatory. The other four are optional and included only if the vendor chose them: Availability, Processing Integrity, Confidentiality and Privacy.

Check which were in scope. A vendor whose service you depend on for uptime, with a report covering Security only, has not been assessed on availability at all — and that is a reasonable question to ask them.

SSAE 18 is the attestation standard the engagement is performed under, which is where the term appears; it is the framework rather than the report.

Reading the report

Scope comes first. Which systems, which services, which locations. A large vendor may have one product in scope and the one you are buying outside it, and the scope section is where you find out.

The opinion is the auditor's conclusion. Unqualified means no material issues; anything else — qualified, adverse, or a disclaimer — is a significant finding and warrants reading carefully rather than filing.

Exceptions are the section people skip and the most informative part. Where testing found a control did not operate as described, the exception is recorded along with management's response. A handful of minor exceptions is normal and honest; a pattern of exceptions in access management or change control is a real signal about how the organization operates.

Complementary user entity controls are the section people miss entirely. These are the things you must do for the vendor's controls to be effective — configure access correctly, enable multi-factor authentication, review your own user list, manage your encryption keys. The vendor's report explicitly assumes you are doing them, and if you are not, their assurance does not extend to you. This is the same division formalized by the cloud shared responsibility model, expressed in audit language.

Subservice organizations matter too. Where a vendor relies on another provider, the report either carves that provider out of scope or includes it. A carve-out means you need that provider's report as well, and the chain can run several deep.

What it does not tell you

An audit assesses controls against stated criteria over a past period. It does not mean the vendor was not breached, that controls are still operating today, or that their controls meet your requirements rather than a general standard.

Use it as one input to vendor assessment alongside your own questions, contractual security commitments, breach notification terms, and the access restrictions you apply to the vendor yourself — the programme described under supply chain security, where accountability stays with you whatever the report says.

Exam angles

Distinguish SOC 1 (financial reporting), SOC 2 (trust services criteria, restricted use) and SOC 3 (public summary). Know Type I as design at a point in time and Type II as operating effectiveness over a period, with Type II as the meaningful one. Name Security as the mandatory criterion and Availability, Processing Integrity, Confidentiality and Privacy as optional. Recognize complementary user entity controls as obligations placed on the customer, and exceptions as the section that carries the real findings.