SOC 3

The SOC 3 Report, just like SOC 2, is based upon the Trust Service Principles and performed under AT101, the difference being that a SOC 3 Report can be freely distributed (general use) and only reports on if the entity has achieved the Trust Services criteria or not (no description of tests and results or opinion on description of the system). The lack of a detailed report requires that a SOC 3 be performed as a Type II, unlike SOC 1 and SOC 2 where there is a Type I option. SOC 3 reports can be issued on one or multiple Trust Services principles (security, availability, processing integrity, confidentiality and privacy) and allow the organization to place a seal on their website upon successful completion.

The Trust Service Principles were designed with a focus on e-commerce systems due to the amount of private/confidential/financial information that flows across the internet daily. When a customer processes a transaction (online retailer), builds a business on your service (SaaS providers), or submits private information, they want to know best practices are being followed by the company to guard against security leaks, lost sales, and damaged data. The most common reports based upon the trust principles are referred to as WebTrust and SysTrust.

The SysTrust review encompasses a combination of the following principles:

• Security: The system is protected against unauthorized access (both physical and logical).
• Availability: The system is available for operation and use as committed or agreed.
• Processing Integrity: System processing is complete, accurate, timely, and authorized.
• Confidentiality: Information designated as confidential is protected as committed or agreed.

The WebTrust certification can fall into the following four categories:

• WebTrust: The scope of the engagement includes any combination of the trust principles and criteria.
• WebTrust Online Privacy: The scope of the engagement is based upon the online privacy principle and criteria.
• WebTrust Consumer Protection: The scope of the engagement is based upon the processing integrity and relevant online privacy principles and criteria.
• WebTrust for Certification Authorities: The scope of the engagement is based upon specific principles and related criteria unique to certification authorities.