SOC 2 Type 1 vs Type 2: what the difference means for you
Type 1 reports on control design at a point in time; Type 2 reports on controls operating over a period. Which buyers accept, how long each takes, and when to go straight to Type 2.
The short answer
A SOC 2 Type 1 report describes your controls and the auditor's opinion that they were suitably designed on a specific date. A Type 2 report adds the auditor's tests that the controls operated effectively over a review period, usually three to twelve months, which is why enterprise buyers ask for Type 2. Type 1 is the fast first milestone when a deal is waiting; Type 2 is the one that keeps the next deals from asking again.
SOC 2 Type 1 and SOC 2 Type 2, row by row
| SOC 2 Type 1 | SOC 2 Type 2 | |
|---|---|---|
| What it covers | Control design at a point in time | Control design and operating effectiveness over a period |
| Review period | None; a single date | Three to twelve months (six and twelve are common) |
| Time to the report | Weeks, once the controls exist | The review period plus the examination |
| What buyers think | A useful start; most ask when Type 2 is coming | The report enterprise procurement expects |
| Evidence needed | That each control exists and is designed well | That each control operated throughout the period, with samples |
| With Viglyn | Continuous checks show design readiness in days | The same checks are the operating evidence for the whole period |
The questions that decide it
Should we skip Type 1 and go straight to Type 2?
If no deal is waiting on a report, yes: start the review period as soon as the controls are in place and let the first report be a Type 2. If a buyer needs something in weeks, a Type 1 bridges the gap and the Type 2 period can start the same day.
How long should the first Type 2 period be?
Three months is the shortest auditors commonly accept for a first report and gets you a Type 2 soonest; six months carries more weight; twelve is standard once you are established. The period can start as soon as the controls operate, which in Viglyn is when the checks pass.
What happens if a control fails during the period?
The auditor reports it as an exception, with management's response. One exception does not fail the report; buyers read the exceptions and the response. Continuous checks catch failures as they happen, so they are fixed inside the period instead of discovered at the end.
More questions
Does a Type 1 expire?
Can the Type 2 period start before the Type 1 report is issued?
What does the auditor sample in a Type 2?
Standards buyers weigh against each other
Find out which one you are closer to
A practitioner maps your gaps for the framework you are going for, in the order to close them, and tells you the honest timeline. Free, no account, no card.