SOC 3 Report – WebTrust and SysTrust

The SOC 3 Report , just like SOC 2, is based upon the Trust Service Principles and performed under AT101, the difference being that a SOC 3 Report can be freely distributed (general use) and only reports on if the entity has achieved the Trust Services criteria or not (no description of tests and results or opinion on description of the system). The lack of a detailed report requires that a SOC 3 be performed as a Type II, unlike SOC 1 and SOC 2 where there is a Type I option. SOC 3 reports can be issued on one or multiple Trust Services principles (security, availability, processing integrity, confidentiality and privacy) and allow the organization to place a seal on their website upon successful completion.

The Trust Service Principles were designed with a focus on e-commerce systems due to the amount of private/confidential/financial information that flows across the internet daily. When a customer processes a transaction (online retailer), builds a business on your service (SaaS providers), or submits private information, they want to know best practices are being followed by the company to guard against security leaks, lost sales, and damaged data. The most common reports based upon the trust principles are referred to as WebTrust and SysTrust.

The SysTrust review encompasses a combination of the following principles:

    • Security: The system is protected against unauthorized access (both physical and logical).
    • Availability: The system is available for operation and use as committed or agreed.
    • Processing Integrity: System processing is complete, accurate, timely, and authorized.
    • Confidentiality: Information designated as confidential is protected as committed or agreed.
  •  
  •  

The WebTrust certification can fall into the following four categories:

  • WebTrust. The scope of the engagement includes any combination of the trust principles and criteria .
  • WebTrust Online Privacy. The scope of the engagement is based upon the online privacy principle and criteria.
  • WebTrust Consumer Protection. The scope of the engagement is based upon the processing integrity and relevant online privacy principles and criteria.
  • WebTrust for Certification Authorities. The scope of the engagement is based upon specific principles and related criteria unique to certification authorities.

Get Our Emails

SOC Reporting Guide

Popular Resources

SOC 2 Cheat Sheet

SANS put together a great overview of SOC 2 terminology, report structure breakdown, and process in their signature cheat sheet format. This is a great document to keep handy if

Read More »

SOC 1 Report

A SOC 1 Report (System and Organization Controls Report) is a report on Controls at a Service Organization which are relevant to user entities’ internal control over financial reporting. The

Read More »