SOC 2 Type 1 or Type 2: Which One You Need, and When

A customer asks for your SOC 2 report. You do not have one. The first decision is which kind to pursue, and getting it wrong costs either months or a second audit.

The distinction

Type 1 reports on whether your controls are suitably designed at a point in time. The auditor examines your controls on a given date and opines on whether, as designed, they would achieve the stated objectives.

Type 2 reports on whether those controls operated effectively over a period — typically three to twelve months. The auditor samples evidence across the window and opines on whether the controls actually worked, consistently, over time.

A Type 1 says "this is well built". A Type 2 says "this has been working". Customers overwhelmingly want the second, because a control that exists on paper and a control that runs every month are different things — and the gap between them is where incidents happen.

Which one to pursue

Go straight to Type 2 if you can. It is what most customers mean when they ask for SOC 2, and a Type 1 often buys less time than people expect.

Type 1 first makes sense when:

• a deal is contingent on showing progress within weeks, and the customer explicitly accepts Type 1 as an interim step
• you have just built the control environment and want external validation of the design before running it for a year
• you want a forcing function — an auditor's design opinion finds gaps that internal review misses

Do not pursue Type 1 if the customer has said they need Type 2, because you will pay for two audits and still arrive at the same place.

Ask the customer directly, in writing: will a Type 1 satisfy your requirement, or do you need Type 2? Most procurement teams will answer plainly, and the answer saves you a five-figure decision made on assumption.

The timeline, realistically

Type 1: three to six months from standing start to report. Most of that is building and documenting controls; the audit itself is short.

Type 2: add the observation window. A three-month window is the shortest anyone will usually accept; six or twelve months is more common, and some customers specifically require twelve.

So from zero to a twelve-month Type 2 is realistically fifteen to eighteen months. From zero to a three-month Type 2 is perhaps nine. Start before you need it, because the one thing you cannot compress is elapsed time with controls running.

Choosing the Trust Services Criteria

SOC 2 covers five criteria. Security is mandatory; the rest are optional:

• Security — required, always
• Availability — commit only if you have meaningful uptime obligations and can evidence them
• Confidentiality — relevant where you handle customer data under confidentiality terms
• Processing Integrity — relevant for transaction processing; often not applicable
• Privacy — the heaviest, and only needed where you handle personal information in ways that warrant it

Every criterion added expands scope, cost and the number of controls you must operate. Start with Security alone unless a customer has specifically asked for more. Adding criteria later is normal.

What actually makes the audit hard

Not the controls — the evidence.

A Type 2 auditor samples across your window and asks for proof that each control ran. If your access review happened but produced no artefact, it did not happen as far as the audit is concerned. The organisations that struggle are not the ones with weak security; they are the ones with good security and no record of it.

Practically, this means from day one of your observation window:

• Every recurring control produces a dated artefact with evidence of who performed it
• Tickets carry approvals — change management evidence is usually reconstructed painfully after the fact
• Access reviews are exported and stored, not just performed in a console
• Onboarding and offboarding leave a trail showing access granted and revoked, with dates
• Vendor reviews are documented, with the assessment attached
• Incidents, including minor ones, are logged with the response

Set up the evidence collection before the window starts. Retrofitting evidence for a period that has already elapsed ranges from expensive to impossible.

What a report is and is not

A SOC 2 report is an auditor's opinion on controls you defined, against criteria you selected, in a scope you set. It is not a certification, there is no pass mark, and two reports are not directly comparable.

Read the scope and the exceptions sections of any report you receive from a vendor. A clean opinion over a narrow scope can be less meaningful than a report with noted exceptions over a broad one.

Which also means: a competitor's SOC 2 does not necessarily cover more than yours. Scope is a choice.

The realistic cost structure

• Readiness work — building and documenting controls. The largest line, whether internal time or a consultant
• Compliance tooling — evidence collection and continuous monitoring. Optional but it pays for itself on a Type 2
• The audit — the smallest line, and the one people anchor on
• Ongoing operation — the controls must keep running, every year, forever

That last one is the part underestimated most. SOC 2 is not a project with an end. The report expires, the window restarts, and the controls need to run continuously in between.

Budget for the operating cost, not just the audit, or the second year is a surprise.