SOC 2 Type 1 vs Type 2: Which Report Do You Need?

SOC 2 Type 1 vs Type 2 comes down to time. A Type 1 report gives a licensed CPA firm’s opinion on whether your controls are suitably designed and in place on a single date. A Type 2 report covers the same design question, then tests whether the controls operated effectively throughout an observation period, commonly three to twelve months. Type 2 is the report most enterprise customers ask for; a Type 1 is often a stepping stone towards it.

Both types report on the same thing: the system behind a service you provide, measured against the AICPA’s Trust Services Criteria. What changes is how much the CPA firm tests and how much assurance the reader gets. This guide explains the difference, how long the observation period should be, which report buyers accept, and when to skip Type 1 altogether. If you are new to SOC 2 itself, start with our SOC 2 compliance guide.

SOC 2 Type 1 vs Type 2: what is the difference?

A Type 1 report asks whether the right controls are designed and in place today. A Type 2 report asks whether those controls worked, every time, across a period.

Type I and Type II are the same reports written with Roman numerals. The Type 1 and Type 2 split also exists for SOC 1 reports, which cover controls relevant to customers’ financial reporting instead of the Trust Services Criteria. The AICPA sets out the reports CPA firms can provide on its SOC suite of services page.

What is a SOC 2 Type 1 report?

A SOC 2 Type 1 report is a CPA firm’s opinion that, on a specified date, your system description is fairly presented and your controls were suitably designed to meet the Trust Services Criteria in scope. The firm checks that each control exists and would achieve its aim if it operated as described. It does not test whether controls worked over time.

A Type 1 is useful when you need a report quickly, when controls are new and have no history yet, or when a customer will accept one as proof of progress. Its limit is that it says nothing about whether controls actually ran: a quarterly access review that exists on paper looks the same in a Type 1 as one that has run for years.

What is a SOC 2 Type 2 report?

A SOC 2 Type 2 report is a CPA firm’s opinion that your controls were suitably designed and operated effectively throughout a defined period. The firm selects samples from each control’s population, such as joiners, leavers, changes, alerts or access reviews, and inspects the evidence for each. How many samples it takes depends on how often the control runs and on the firm’s own methodology.

Where a sample fails, the report lists an exception. Exceptions do not automatically lead to a qualified opinion; the CPA firm considers whether the criteria were still met. Customers read the exceptions closely, though, so evidence discipline throughout the period matters as much as control design.

How long is a SOC 2 Type 2 observation period?

The Trust Services Criteria do not set a fixed observation period, and you agree the dates with your CPA firm. Periods of three to twelve months are common. A first Type 2 often covers three to six months so the report arrives sooner, and later reports usually cover twelve months, running back to back so there is no gap in coverage.

Three points about the window are easy to miss:

• Controls must be running on day one. The period should start only when every control in scope is operating and producing evidence. Gaps found during the period become exceptions, not fixes.
• Annual controls need a date inside the window. Risk assessment, policy review, disaster recovery testing and the penetration test all need to happen during the period if you want them tested.
• Reports age. A Type 2 covers a past period. Customers asking in the months after it ends often accept a bridge letter: a statement from your own management that controls have not materially changed since the period ended. The CPA firm does not issue it.

Which report do customers accept?

Most enterprise buyers ask for a Type 2. A Type 1 is often accepted as an interim step, sometimes with a contractual commitment to deliver a Type 2 by a set date. Ask each buyer what they will accept before you choose, and read the wording of their security schedule or questionnaire.

Should you start with SOC 2 Type 1?

Start with Type 1 if a deal needs a report within weeks, or if your controls are new and you want the CPA firm to confirm the design before the observation period starts. Go straight to Type 2 if no buyer is waiting, your controls already run and produce evidence, and you would rather pay for one examination than two.

A Type 1 has a practical benefit beyond the report: it works as a dry run. Design problems found at Type 1 can be fixed before the Type 2 period begins, rather than becoming exceptions within it. The cost is a second round of fieldwork. For SaaS companies selling into the US, the deciding factor is usually the date a named customer needs to see a report.

How do you move from Type 1 to Type 2?

Most companies start the Type 2 observation period soon after the Type 1 date, so the two reports join up.

1. Fix design findings first. Anything the CPA firm raised at Type 1 should be resolved before the period begins.
2. Agree the period with the CPA firm. Set the start and end dates and the criteria in scope; adding a category later means a new scope.
3. Collect evidence as you go. Tickets, approvals, review sign-offs and logs should be captured when each control runs, not reconstructed at the end.
4. Schedule annual and quarterly controls. Put the penetration test, risk assessment, access reviews and disaster recovery test in the calendar inside the period.
5. Keep vulnerability management visible. Regular vulnerability scanning with tracked remediation supports the CC7.1 criterion throughout the period.
6. Plan the next period. Once the first Type 2 is issued, the next period usually starts the day after the last one ended.

What drives the time and cost of each type?

CPA firms set their own fees, so we give no prices here. The same few factors drive both time and cost:

For the end-to-end timeline, from scoping to the final report, see how long SOC 2 takes in our compliance guide.

Where does penetration testing fit in each type?

For a Type 1, a penetration test before the report date shows that your vulnerability management controls are designed and in place. For a Type 2, the test needs to happen inside the observation period, with findings fixed and retested inside the period too, so the CPA firm can test the control as it operated. Our page on SOC 2 penetration testing covers scope, timing and report format in detail.

Why Sovereign Secure

We are not a CPA firm and we do not issue SOC 2 Type 1 or Type 2 reports. What we provide is evidence the examination relies on:

• Penetration testing of web applications, APIs, cloud environments, networks and mobile apps, scoped to your system description and scheduled inside your observation period, with retests.
• Vulnerability scanning to keep CC7.1 evidence flowing between tests.
• ISO 27001 certified, with ISO 27001 consultancy for companies whose UK and European customers ask for certification as well. Certification audits are carried out by our partner certification body, MQA International.
• A UK company since 2012, headquartered in Accrington, Lancashire, with an office in Los Angeles, and a PCI SSC Qualified Security Assessor (QSA) company for SaaS platforms that handle card data.

Plan your testing around your SOC 2 period

Send us your Type 1 date or Type 2 period, the applications and cloud accounts in scope and any requirements from your CPA firm, and we will schedule a test that lands where it counts. Request a penetration testing quote or call +44 161 523 5276.