SOC 2 compliance › Type 1 vs Type 2
SOC 2 report typesSOC 2 Type 1 vs Type 2: which report do you need?
Type 1 shows your controls are designed properly on one date. Type 2 shows they kept working over a period. This guide explains what each tests, what evidence it needs and how to choose before you pay for either.
Free for buyers · provider-funded introductions · Updated October 2026
What each report actually tests
Both are SOC 2 reports from a CPA firm, against the same Trust Services Criteria. They differ in the question the auditor answers.
Type 1: design at a point in time
The auditor reviews your system description and tests whether the controls you describe are suitably designed to meet the criteria in scope, as of a single date.
It does not show that the controls ran consistently afterwards. A buyer reading a Type 1 learns what you intend to do, not what you have been doing.
Type 2: design and operation over a period
The auditor tests the same design, then samples evidence across an observation period to check that the controls operated effectively the whole time: access reviews completed, changes approved, incidents handled.
This is the report that answers a security team's real question: does it work in practice, repeatedly.
SOC 2 Type 1 vs Type 2 compared
| Type 1 | Type 2 | |
|---|---|---|
| Question answered | Is the design suitable? | Is the design suitable and did it operate effectively? |
| Time covered | One date | A defined observation period agreed with the auditor |
| Evidence | Policies, configurations and screenshots showing the control exists | Samples across the period: access reviews, tickets, approvals, logs, training records |
| Auditor effort | Lighter testing: design only | Heavier testing: design plus operating effectiveness |
| Your team's effort | Get controls in place and documented | Run the controls consistently and keep evidence all period |
| How buyers treat it | Evidence you have started; some will accept it for a limited time | The assurance most enterprise security reviews expect |
| Main limitation | Says nothing about whether controls kept working | Needs time: the observation period cannot be compressed |
| Typical role | First milestone while the Type 2 window runs | The steady-state report, repeated annually |
Cost and timing depend on scope, criteria, maturity and the auditor's engagement model, so we do not quote a price here. See what drives SOC 2 cost before you request quotes.
How to choose between Type 1 and Type 2
Choose the report your customer will accept, not the one that is easiest to produce.
A Type 1 can make sense when…
- The customer has said in writing that a Type 1 is acceptable for now.
- You need to show progress on an open deal while a Type 2 window runs.
- Your controls are newly built and you want the auditor's design feedback first.
Go straight to Type 2 when…
- The questionnaire or contract asks for Type 2, or just "SOC 2".
- Your controls already operate and produce evidence.
- You would otherwise pay for a Type 1 and then repeat the audit work for Type 2.
When a customer says “SOC 2” with no detail, ask which report and which period they need. Do not assume Type 1 will do: many security teams will not treat it as a substitute.
How companies commonly move from Type 1 to Type 2
Not everyone does both, but this is the common sequence for a first report.
Scope and fix gaps
Agree criteria and system boundary, run a readiness check and close the gaps. Security is always in scope.
Optional Type 1
The auditor tests design as of a date. Only worth doing if your customer accepts it or you want the auditor's design feedback.
Type 2 window and report
Controls run and evidence builds across the observation period. Fieldwork follows and the auditor issues the report.
The full process is in our SOC 2 roadmap, and the Type 2 report is explained in this guide.
Questions to settle first
- Ask the customer: do you accept a Type 1, and until when?
- Ask the customer: what observation period do you expect on a Type 2?
- Ask the auditor: what period will you accept for our first Type 2?
- Ask the auditor: what is included in the quote: fieldwork, retests, report issuance?
- Ask yourself: do our controls already run and leave evidence?
- Ask yourself: which criteria do contracts actually require?
Common mistakes
- Buying a Type 1 by default and then discovering the customer wanted Type 2.
- Starting the window too early, before controls reliably operate, and creating exceptions.
- Over-scoping criteria that no contract requires.
- Treating evidence as an end-of-period task instead of capturing it as controls run.
Type 1 vs Type 2 questions
Is SOC 2 Type 2 better than Type 1?
Do I need a Type 1 before a Type 2?
How long is the Type 2 observation period?
Can a startup skip Type 1?
Will customers accept a Type 1 report?
Is a Type 2 report a certificate?
Start with the requirement, not the auditor.
Free for buyers · provider-funded introductions