Free tool
SOC report chooser
SOC 1, SOC 2 and SOC 3 reports answer different questions for different readers, and Type 1 and Type 2 suit different timelines. Answer 5 questions to see which report fits.
How it works
- 1Answer 5 questions about your service, what customers are asking for, whether you want a public report, when you need it and whether a Type 2 has been requested.
- 2Your answers decide the report (SOC 1, SOC 2, or both, plus a SOC 3 public summary if you want one) and the type (Type 1 first, or straight to Type 2).
- 3See the recommended report and type, with notes on why, and links to our guides comparing the reports and the two types.
Your answers stay in your browser and are never sent anywhere.
Question 1 of 50% done
Frequently asked questions
Only a licensed CPA firm can issue a SOC 1, SOC 2 or SOC 3 report. A consultant prepares you; the CPA firm performs the independent examination.
Usually 3 to 12 months. Many first-time reports use 3 to 6 months.
No. It's an attestation report with the auditor's opinion on your controls. There's no SOC 2 certificate.