SOC 2 Type 1 vs Type 2: What's the Difference and Which Should You Get First?

What each report tells a buyer

A Type 1 report describes whether your controls are suitably designed, as of a specific date. It answers: "Do you have the right controls in place today?"

A Type 2 report covers the same design question and adds operating effectiveness across an observation period, commonly three to twelve months. It answers: "Did those controls actually work, consistently, over time?" Many enterprise buyers ask for Type 2 for that reason.

The Trust Services Criteria

SOC 2 is organized around the AICPA Trust Services Criteria. The Security category is required and forms the common criteria (the "CC" controls) that every report includes. The other categories are optional and should be chosen based on what your customers need:

• Availability: uptime commitments, capacity planning, backup and recovery
• Processing integrity: complete, valid, and accurate processing of customer data
• Confidentiality: how confidential information is identified, protected, and disposed of
• Privacy: personal information handling across its lifecycle

Adding categories increases the number of controls and the testing burden. Add them because a customer needs them, not because they sound thorough.

What auditors actually test

For a Type 2 report, the CPA firm samples evidence across the observation period. The samples are where most companies struggle. Typical test areas include:

• Access provisioning and deprovisioning, with timely offboarding evidence
• Quarterly or periodic access reviews, signed off by an owner
• Change management tickets with approvals and testing records
• Vulnerability scanning and remediation tracking
• Vendor risk reviews for critical suppliers
• Incident response tests and lessons-learned records

A practical path

If a customer needs a report this quarter, a Type 1 can serve as a credible milestone, and it gives you a design review before the observation period starts. Do not assume a buyer will accept it in place of a Type 2. Confirm that in writing first. Once the controls are stable, run the Type 2 observation period and keep evidence as you go. Retroactively assembling evidence for a sample is slower and riskier than collecting it in the normal course of work.

Mistakes that extend the timeline

• Scoping too narrowly, then discovering a buyer expects a production system that was left out
• Writing policies nobody follows, which auditors detect quickly in sampling
• Reviews that happen but are not documented with dates and sign-offs
• Offboarding delays that show up as exceptions in the sample