Nine times out of ten, the customer asking you for a SOC 2 wants a Type 2. If someone in a security review says “send us your SOC 2” without qualifying it, assume Type 2 and ask them to confirm. A Type 1 will sometimes buy you time or unblock a deal, but it is rarely what the request means.
The SOC 2 Type 1 vs Type 2 difference is simpler than the naming suggests. A Type 1 reports on whether your controls were suitably designed as of one specific date. A Type 2 reports on whether those same controls were suitably designed and operated effectively across a period of time — three months, six months, twelve months. Type 1 is a photograph. Type 2 is the security footage.
What the auditor is actually opining on
Both reports contain a description of your system written by you, a written assertion from your management, and an independent service auditor’s opinion. What changes is the scope of that opinion.
In a Type 1, the service auditor opines on two things: whether your description of the system is presented fairly, and whether the controls in it were suitably designed to meet the applicable trust services criteria as of a stated date — say 30 September.
In a Type 2, the auditor opines on those two things plus a third: whether the controls operated effectively throughout the stated period — say 1 April through 30 September. To support that third opinion, the auditor tests controls. A Type 2 report therefore includes a section listing each control, the procedures performed to test it, and the results, including any exceptions found.
That test section is the part your customer’s security team actually reads. It is also the part a Type 1 does not have.
The practical comparison
| Type 1 | Type 2 | |
|---|---|---|
| Coverage | One date | A period (commonly 3–12 months) |
| Opinion covers | Description and design | Description, design, and operating effectiveness |
| Includes tests of controls and results | No | Yes |
| Evidence needed from you | Current state: policies, configurations, system settings | Populations and samples across the whole period |
| What a buyer learns | You have designed sensible controls | Your controls actually ran |
| Typical time to produce | Weeks after readiness | The window plus fieldwork and reporting |
Why buyers press for Type 2
Put yourself in the reviewer’s chair. They are trying to decide whether to let your platform hold their customer data. A Type 1 tells them you wrote an access control policy and configured SSO on the day the auditor looked. It does not tell them whether anyone was offboarded within a day of leaving, whether quarterly access reviews were actually performed, or whether change approvals were bypassed in a crunch.
Those are operating questions, and only a Type 2 answers them. That is why vendor security programmes at larger enterprises, and most financial services and healthcare buyers, have Type 2 written into their standards. Some will accept a Type 1 as an interim step with a commitment to a Type 2 by a stated date. Others will not, and no amount of explanation moves them.
Ask directly. “Is a Type 1 acceptable for this review, or do you require a Type 2?” is a normal question and reviewers answer it every week.
When a Type 1 genuinely earns its keep
A Type 1 is worth doing in a few specific situations.
You have a deal on the clock and no period behind you. If a contract closes in six weeks, you cannot produce a Type 2 covering a period that has not happened yet. A Type 1 dated soon gives the buyer something independent to look at while you start the observation window.
Your controls are new. If you stood up your access review process, vendor risk process and change management workflow two months ago, a Type 2 covering the last six months will test a period during which half of those controls did not exist. A Type 1 at a date after everything is live, followed by a Type 2 over the following months, is a cleaner sequence.
You want a rehearsal. A Type 1 puts you through system description drafting, control mapping, evidence requests and the auditor relationship without the volume of a Type 2. Teams that do this usually find the design problems — a policy that says quarterly but a process that runs annually, a control with no owner — while they are still cheap to fix.
When a Type 1 is money you did not need to spend
If your buyer has already told you they need a Type 2, a Type 1 does not shorten the path. It is a separate examination with its own fee, its own system description and its own report, and the Type 2 that follows does not get materially cheaper because you did one.
If your controls have been running consistently for six months already, skip straight to a Type 2 over that period, provided you can produce evidence for it. The evidence test is the deciding factor: can you show ticket histories, access review records, onboarding and offboarding trails, and vulnerability scan results going back across the period? If yes, the Type 1 adds nothing your buyer wants.
And if you are early enough that neither report is realistic yet, a readiness assessment usually delivers more value than a Type 1. It tells you what to fix. A Type 1 tells the world what you fixed.
The sequence most first-timers end up running
A common path looks like this. You get asked for a SOC 2. You do a readiness assessment and remediate gaps over a couple of months. You either issue a Type 1 at that point because a deal needs it, or you skip it. You start a Type 2 observation window — often three to six months for a first report. At the end of the window the auditor performs fieldwork and issues the Type 2. From then on you run annual Type 2s, usually over twelve-month periods, with each period beginning where the last one ended so there is no uncovered gap.
That continuity matters more than founders expect. Buyers reading your second and third reports will check whether the periods join up. A gap between periods invites the question of what happened during it.
What to do next
Go back to whoever asked you for the report and get three answers in writing: Type 1 or Type 2, which trust services criteria they expect beyond Security, and the date they need it by. Those three answers determine your scope, your timeline and your cost more than anything else you decide.
Then check whether you can evidence your controls backwards. Pull one quarter of access reviews, one month of change approvals and your last vulnerability scan. If they exist and have dates and approvers on them, you are closer to a Type 2 than you think. If they do not, that is your real starting point.
Assurion is a licensed CPA firm and performs both Type 1 and Type 2 SOC 2 examinations; we are happy to tell you which one your situation calls for before you commit to either.