SOC 3 · General-use trust services report
SOC 3 report and requirements, prepared for assurance you can publish on your own website.
A SOC 3 report lets any prospect, partner or member of the public read an independent CPA firm's conclusion on your controls, without a non-disclosure agreement. Sterling's expert and experienced consultants get the controls, the system boundaries and the evidence ready for that examination, and stay with you until the report is in your hands. We ensure a successful SOC 3 examination for our clients.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced information security consultants, with trust services controls consulting delivered across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not issue the report; a licensed CPA firm examines and gives its opinion
8,100+ client engagements in 60+ countries.
SOC 3 client experience
What it is
What is a SOC 3 report and what is it used for?
SOC 3 is the general-use report in the AICPA's SOC suite. It reports on the same subject as SOC 2, controls relevant to security, availability, processing integrity, confidentiality and privacy, measured against the same Trust Services Criteria. The difference is depth. A SOC 3 report leaves out the detail a SOC 2 report carries, and because of that the AICPA treats it as a general-use report that can be freely distributed.
Organisations post it on a trust page or attach it to tenders, where a full SOC 2 would need an NDA. The illustrative report the AICPA publishes contains four parts: management's assertion, the description of the boundaries of the system, the principal service commitments and system requirements, and the service auditor's report. For the criteria in depth and the Type 1 and Type 2 reports, see the SOC 2 hub.
Current criteria. The 2017 Trust Services Criteria, reissued with revised points of focus in 2022. No SOC 3 revision was in progress when this page was written; confirm the current guidance with your CPA firm before you plan.
Who it is for
Who needs a SOC 3 report?
SOC 3 suits service organisations whose controls matter to readers who will never see a full SOC 2. Requests usually start in one of four places:
- Customers want proof before they talk to sales. A report on your trust page answers the first security question.
- A tender asks for independent assurance. Check whether the buyer will accept a general-use report or insists on the detailed SOC 2.
- A regulator or sector body expects visible controls. Read the wording carefully; a SOC 3 may support your case, but it is not a licence or a certificate.
- The group already runs a SOC 2 examination. Adding a SOC 3 turns work already done into something the whole market can see.
Requirements
What are the main SOC 3 requirements?
A SOC 3 examination uses the Trust Services Criteria, so the requirements are the criteria for the categories you choose, plus the elements the report itself must contain. The list stays at heading level; your controls are examined against the AICPA criteria themselves.
- Security (the common criteria): control environment, communication and information, risk assessment, monitoring activities, control activities, logical and physical access controls, system operations, change management and risk mitigation.
- Availability: capacity and recovery that meet your availability commitments.
- Processing integrity: processing that is complete, valid, accurate, timely and authorised.
- Confidentiality: confidential information protected and disposed of as committed.
- Privacy: personal information handled in line with your privacy commitments.
- Management's assertion: your written statement about the controls, which the service auditor reports on.
- System boundaries, service commitments and system requirements: a short description of what the report covers and what you have promised customers.
What does useful SOC 3 evidence look like?
Dated records the service auditor can sample: access reviews on schedule, changes approved before release, incidents reviewed, vulnerabilities fixed within policy. Plus a boundary description short enough for a general reader and accurate enough to report on.
Attestation process
How do you get a SOC 3 report?
There is no certificate at the end. A licensed CPA firm, acting as service auditor, examines your controls, forms an opinion and issues the report.
- 01Fix the system, the categories and the audience.Agree which service, locations and teams are in scope, which categories customers expect, and whether you need SOC 2 as well.
- 02Gap analysis: compare current controls with the criteria.We map what you already operate to each criterion, find what is missing or unproven, and agree actions, owners and dates.
- 03Close the gaps and start the evidence calendar.Policies, technical controls, training and the boundary description are completed, and each control begins producing dated records.
- 04Test readiness, then run the period.Sterling tests controls as the service auditor will; they then operate through the period agreed with the CPA firm.
- 05Complete the CPA firm's examination and publish.The firm samples evidence, discusses exceptions and issues its report and opinion; you publish the SOC 3 and plan the next period.
Check the route before you sign. Only a licensed CPA firm can issue a SOC report, and the AICPA has warned about practitioners who are unlicensed or not enrolled in peer review. Ask for the firm's licence and peer review status and confirm both independently. The certification buyer's checklist
Cost
How much does a SOC 3 report cost?
The SOC 3 itself adds little once a SOC 2 examination is under way; most of the budget sits in getting controls ready and in the service auditor's work over the period.
| Cost component | What affects it |
|---|---|
| Consulting and readiness | Control maturity, the categories and systems in scope, and whether you choose Design™ or Drive™ |
| The CPA firm's examination | Categories, period length, locations sampled, and whether SOC 2 and SOC 3 are issued together, quoted by the firm |
| Your team's time | Engineering changes, tooling and control owners producing evidence through the period |
| Software and learning | Effivity and Sterling Academy access, itemised at no additional cost |
What moves the price
- Security alone, or security with other categories
- Cloud-native controls, or manual processes to redesign
- Countries, sites and subservice providers in scope
What a Sterling proposal always shows
- Scope, assumptions and exclusions written down
- Payments tied to delivered milestones
- One all-inclusive proposal for Sterling's work
Timeline
How long does it take to get a SOC 3 report?
The period drives the calendar. Because a SOC 3 reports on controls that have operated over time, the clock cannot start until they are in place. As an estimate, a first report arrives nine to fifteen months after kick-off, sooner if the controls are mature or the CPA firm agrees a shorter first period.
| Phase | What sets the pace |
|---|---|
| Scope and gap analysis | Access to system owners, cloud consoles and existing policies |
| Remediation | Engineering changes, approvals and training |
| Examination period | The length agreed with the CPA firm, with no break in control operation |
| Fieldwork and report | The firm's availability and how fast evidence requests are answered |
Your engagement
What your SOC 3 engagement includes
Every engagement runs on Sterling OS™, adapted to the Trust Services Criteria. Sterling does not issue the report: an independent, licensed CPA firm examines your controls and gives its opinion, which keeps the report credible to the people reading it.
Design™: guided support
Your engineers and control owners do the work; a Sterling consultant sets the method, reviews each control and coaches the team toward the examination.
Drive™: managed support
An alternative to Design™ for lean teams: Sterling drafts policies, the boundary description and evidence routines with your owners and runs the programme to fieldwork.
Sustain™: after the report
Control testing between periods, evidence checks before the next examination and a refreshed SOC 3 each cycle.
Automate™: Effivity
Controls, owners and evidence run in Effivity, included with the engagement at no additional cost.
Training for your people
Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Opinions and reports remain with the independent CPA firm.
Often combined with
Standards organisations pair with SOC 3
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- CIS ControlsCIS Controls implementation and requirements: the 18 Controls and 153 Safeguards of v8.1, Implementation Groups, assessment with no certificate, cost and time.
- CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.
- CSA STARCSA STAR certification consulting for cloud providers: CCM controls and evidence for a STAR Registry entry by self-assessment, certification or attestation.
- Cyber EssentialsCyber Essentials certification consulting: the five technical controls in place for your verified self-assessment, and Cyber Essentials Plus audit-ready.
- DESC ISR (Dubai)DESC ISR compliance consulting for Dubai government entities and suppliers: information security risks and incidents managed, with the evidence to show it.
Effivity · trust services control software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of SOC 3.
Effivity is the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. For a SOC 3 client, your consultant sets up a workspace within the agreed scope that holds the control set, each control's owner, the evidence it produces and the date it ran, alongside risks, vendors, incidents, policies and training records. The service auditor then samples a period of work that was recorded as it happened. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Roles, oversight and conduct
Security responsibilities, board or management oversight and code-of-conduct acknowledgements held against named roles.
Policies and commitments
Policies published and acknowledged, and the service commitments you make to customers recorded in one place.
Risks tied to your commitments
A risk register refreshed when systems, suppliers or the business change, with owners and treatments followed to closure.
Control testing and deficiencies
A testing calendar, results reviewed by management and deficiencies tracked until they are fixed.
Joiners, movers and leavers
Access requests, removals and periodic reviews logged with dates.
Incidents and vulnerabilities
An incident register with post-incident reviews and a vulnerability log showing remediation inside policy timeframes.
Approved, tested releases
Change records with approvals and test results linked, including emergency changes reviewed after the event.
Vendors and continuity
Vendor assessments, contract terms and continuity tests kept current.
What this means at the audit
The service auditor picks dates in the period and asks who approved that change or when that leaver lost access. In Effivity the answers are already filed with their dates.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your documents, records and registers migrated, not retyped
- Admin and user training for your team
- Modules for EMS, OHSMS, ISMS, FSMS and more when you integrate other standards
Sterling Academy · information security e-learning
Make every control owner understand what the auditor will sample.
Sterling Academy provides video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion that can be verified online. Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Security awareness for every employee, with completion records the service auditor can sample
- Internal auditor training, as applicable to your standard, as part of the engagement
- Completion reports by team, dated inside the examination period
- New joiners trained in their first weeks, so onboarding controls keep working
Keep exploring
Explore more about SOC 3
SOC 3 resources
Services for SOC 3
Why Sterling
Want a successful SOC 3 report? Come to Sterling.
A public report has to be right first time. Sterling prepares one control set that serves SOC 2 and SOC 3 together, with an engagement team accountable from scoping to the opinion.
60+ countries since 2003
Security and assurance programmes for SaaS, BPO, fintech and managed service providers, with offices in 21 countries.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal; the CPA firm's fee quoted separately.
One control set, two reports
The evidence built for SOC 2 carries the SOC 3, and maps across to ISO/IEC 27001 when customers ask for both.
Expert and experienced consultants
Security specialists who learn your architecture before writing controls.
The Sterling Promise
What our SOC 3 success guarantee means
We stay with you until your agreed SOC 3 outcome is achieved, through readiness, the examination period and the resolution of any exceptions the service auditor raises.
The engagement identifies the framework, system, categories, outcome and responsibilities. Your organisation supplies accurate information and operates the agreed controls. The CPA firm examines the controls and retains its opinion. Our commitment concerns the agreed readiness support, not a promise of every future contract award or flawless performance.
FAQs
Frequently asked questions about SOC 3
Is SOC 3 a certification?
No. It is an attestation report: a CPA firm gives an opinion on your controls. There is no certificate, register entry or pass mark, so describe it on your website as a SOC 3 report, not as being SOC 3 certified.
Can we put our SOC 3 report on our website?
Yes. The AICPA treats SOC 3 as a general-use report that can be freely distributed, which is its main purpose. Publish the whole report, not extracts.
Can we get a SOC 3 report without a SOC 2 report?
Ask the CPA firm; in practice most service organisations obtain both from one examination of the same system. Because the SOC 3 shares the SOC 2 criteria, the extra report usually adds little work once the examination is planned.
Will a SOC 3 report satisfy an enterprise customer's security team?
Sometimes, but not always. SOC 3 leaves out the detail of a SOC 2 report, so security teams that assess vendors closely often still ask for the SOC 2 under an NDA.
How long does a SOC 3 report stay current?
It speaks only for the period it covers. Readers expect a recent period, so plan a recurring examination cycle with your CPA firm and replace the published report each time a new one is issued.
Keep exploring
More on SOC 3 and related standards
More in Information security, cyber & cloud
Talk to a consultant
Plan a SOC 3 report your customers can read on day one.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice