What are SOCI/SOCII/SOCIII?

Risk management frameworks provide a structured approach to managing risk, whereas SOC reports are the outcome of an audit against specific control objectives, not a framework itself.

Access controls are mechanisms used to regulate who or what can view or use resources, which might be audited within a SOC report, but SOC reports themselves are not access controls.

SOC reports (SOC 1, SOC 2, and SOC 3) are independent audit reports issued by a CPA firm that assess the effectiveness of a service organization's controls over information systems that affect its customers. They provide assurance regarding the security, availability, processing integrity, confidentiality, and privacy of the data processed by the service organization.

Software development phases describe stages in the software lifecycle, which is unrelated to the purpose of SOC reports.