Does SOC 2 have any sister standards?

Yes, there are a number of SOC reporting standards, but the 3 main standards are SOC 1, SOC 2 and SOC 3.  

SOC 1 is applicable to service organisations that are involved in services or functions related to financial reporting (e.g., payroll service providers).  In almost every case, SOC 1 audits are initiated by a client company’s financial audits.  So, unless a client of your organisation has requested a SOC 1 report, you most likely do not need one.  Like SOC 2 reports, a SOC 1 report is intended only to be shared with particular interested parties and should not be published publicly.  

SOC 3 deals with a similar subject matter to SOC 2 (i.e., information security) however, unlike SOC 1 and 2, a SOC 3 report can be provided to anyone and even published on your organisation’s website.  It is, in essence, a ‘slimmed down’ version of a SOC 2 report, without the confidential information (the description of your organisation’s system, tests of controls and the results of those tests) that makes a SOC 2 report too sensitive to be shared publicly.