AICPA SOC 3
SOC 3 is the AICPA's general-use report on an examination of controls against the Trust Services Criteria: the same work as a SOC 2 type 2 examination, reported as only management's assertion and the service auditor's opinion, without the system description or test results. The framework holds the SOC 3-specific requirements; the criteria sit under SOC 2.
AICPA SOC 3 is a compliance framework from International (AICPA attestation standard, used worldwide) with 4 domains and 31 controls that map to 12 other frameworks. The largest domains are Elements of the service auditor's SOC 3 report (AT-C 205 .63) – AICPA SOC 3 (14 controls), Management responsibilities and assertion – AICPA SOC 3 (9 controls), Suitability and use of a general-use report – AICPA SOC 3 (5 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (4)
Elements of the service auditor's SOC 3 report (AT-C 205 .63) – AICPA SOC 3
| Code | Title |
|---|---|
| aicpa-soc-3::R-63a | Report element: Title containing the word independent |
| aicpa-soc-3::R-63b | Report element: Appropriate addressee |
| aicpa-soc-3::R-63c | Report element: Identification of the assertion and period |
| aicpa-soc-3::R-63d | Report element: Identification of the criteria |
| aicpa-soc-3::R-63e | Report element: Statement of the responsible party's responsibilities |
| aicpa-soc-3::R-63f | Report element: Statement of the service auditor's responsibility |
| aicpa-soc-3::R-63g | Report element: Statements on the attestation standards and evidence |
| aicpa-soc-3::R-63h | Report element: Description of the nature of the examination |
| aicpa-soc-3::R-63i | Report element: Independence and ethics statement |
| aicpa-soc-3::R-63j | Report element: Inherent limitations |
| aicpa-soc-3::R-63k | Report element: Opinion paragraph |
| aicpa-soc-3::R-63l | Report element: Signature of the firm |
| aicpa-soc-3::R-63m | Report element: City and state of issue |
| aicpa-soc-3::R-63n | Report element: Report date |
Management responsibilities and assertion – AICPA SOC 3
| Code | Title |
|---|---|
| aicpa-soc-3::M-1 | Define what the SOC 3 examination covers |
| aicpa-soc-3::M-2 | Specify principal commitments and requirements |
| aicpa-soc-3::M-3 | Identify and analyse risks to commitments and requirements |
| aicpa-soc-3::M-4 | Design, implement, monitor and document effective controls |
| aicpa-soc-3::M-5 | Identify subservice organisations and choose the inclusive or carve-out method |
| aicpa-soc-3::M-6 | Written assertion on control effectiveness throughout the period |
| aicpa-soc-3::M-7 | Disclose system boundaries and principal commitments with the assertion |
| aicpa-soc-3::M-8 | Boundary disclosures cover CUECs, CSOCs, subservice method and scope limitations |
| aicpa-soc-3::M-9 | Select the applicable criteria and hold a reasonable basis for the assertion |
Service auditor's engagement and opinion – AICPA SOC 3
| Code | Title |
|---|---|
| aicpa-soc-3::A-1 | Service auditor's acceptance and planning responsibilities |
| aicpa-soc-3::A-2 | Opinion on management's assertion |
| aicpa-soc-3::A-3 | Modified opinions without reference to test exceptions |
Suitability and use of a general-use report – AICPA SOC 3
| Code | Title |
|---|---|
| aicpa-soc-3::U-1 | Decide whether a SOC 3 will meet intended users' needs |
| aicpa-soc-3::U-2 | Guard against a misleading report when a subservice organisation is carved out |
| aicpa-soc-3::U-3 | Consider restricting use where CUECs are needed |
| aicpa-soc-3::U-4 | Keep the report general-use: no description, no tests and results |
| aicpa-soc-3::U-5 | Restrict use when groups of readers are likely to misunderstand |
Your Compliance Coverage
If you comply with AICPA SOC 3, you already cover:
SOC 2
25%
13 controls mapped
Compare →ISO 27018:2019
4%
2 controls mapped
Compare →ISO 27002:2022
4%
2 controls mapped
Compare →+ 9 more: ISO 45001:2018 (2%), ISO 55001:2014 (2%)
See all 12 mapped frameworks ↓Maps to 12 other frameworks
Coverage is not the same as your position
This page shows what AICPA SOC 3 overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is AICPA SOC 3 and who does it apply to?
AICPA SOC 3 is a compliance framework from International (AICPA attestation standard, used worldwide) with 4 domains and 31 controls. SOC 3 is the AICPA's general-use report on an examination of controls against the Trust Services Criteria: the same work as a SOC 2 type 2 examination, reported as only management's assertion and the service auditor's opinion, without the system description or test results. The framework holds the SOC 3-specific requirements; the criteria sit under SOC 2. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does AICPA SOC 3 actually require?
AICPA SOC 3 has 31 controls organised across 4 domains. The largest domains are Elements of the service auditor's SOC 3 report (AT-C 205 .63) – AICPA SOC 3 (14 controls), Management responsibilities and assertion – AICPA SOC 3 (9 controls), Suitability and use of a general-use report – AICPA SOC 3 (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of AICPA SOC 3 do I already cover?
AICPA SOC 3 maps to 12 other compliance frameworks. The top mapping partners are SOC 2 (25% coverage), ISO 27018:2019 (4% coverage), ISO 27002:2022 (4% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement AICPA SOC 3?
Start your AICPA SOC 3 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about AICPA SOC 3 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 31 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,121 frameworks.
Get Started Free →Free forever, no credit card required