instruction: Give me an overview of the different types of SOC reports and what they are used for
context: System and Organization Controls (SOC), (also sometimes referred to as service organizations controls) as defined by the American Institute of Certified Public Accountants (AICPA), is the name of a suite of reports produced during an audit. It is intended for use by service organizations (organizations that provide information systems as a service to other organizations) to issue validated reports of internal controls over those information systems to the users of those services. The reports focus on controls grouped into five categories called Trust Service Principles. The AICPA auditing standard Statement on Standards for Attestation Engagements no. 18 (SSAE 18), section 320, "Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting", defines two levels of reporting, type 1 and type 2. Additional AICPA guidance materials specify three types of reporting: SOC 1, SOC 2, and SOC 3.
  
  Trust Service Principles
  SOC 2 reports focus on controls addressed by five semi-overlapping categories called Trust Service Principles which also support the CIA triad of information security:
  
  Security
  Firewalls
  Intrusion detection
  Multi-factor authentication
  Availability
  Performance monitoring
  Disaster recovery
  Incident handling
  Confidentiality
  Encryption
  Access controls
  Firewalls
  Processing Integrity
  Quality assurance
  Process monitoring
  Adherence to principle
  Privacy
  Access control
  Multi-factor authentication
  Encryption
  Reporting
  Levels
  There are two levels of SOC reports which are also specified by SSAE 18:
  
  Type I, which describes a service organization's systems and whether the design of specified controls meet the relevant trust principles. (Are the design and documentation likely to accomplish the goals defined in the report?)
  Type II, which also addresses the operational effectiveness of the specified controls over a period of time (usually 9 to 12 months). (Is the implementation appropriate?)
  Types
  There are three types of SOC reports.
  
  SOC 1 – Internal Control over Financial Reporting (ICFR)
  SOC 2 – Trust Services Criteria
  SOC 3 – Trust Services Criteria for General Use Report
  Additionally, there are specialized SOC reports for Cybersecurity and Supply Chain.
  
  SOC 1 and SOC 2 reports are intended for a limited audience – specifically, users with an adequate understanding of the system in question. SOC 3 reports contain less specific information and can be distributed to the general public.
response: The different types of SOC reports are SOC 1, SOC 2, and SOC 3. Each report is used for a third party organization to understand the controls of another organization. SOC 1 reports cover controls over financial reporting, SOC 2 reports cover the trust services criteria (security, availability, confidentiality, processing integrity, and privacy), and SOC 3 reports are  general use SOC 2 reports.