SOC 2 Type 1 vs Type 2: What's the Difference?

If you sell software to other businesses, a SOC 2 report request usually arrives with a security questionnaire, often during a deal that matters. The next question is which kind of report to pursue: Type 1 or Type 2. Both are attestation reports issued by a licensed CPA firm under AICPA standards, and both evaluate controls against the Trust Services Criteria. They differ in what the auditor is willing to say about those controls, and that difference shapes cost, timing, and how buyers read the result.

This guide explains what each report covers, what auditors test, how the costs and timelines compare, when a Type 1 is likely to be accepted, and how companies typically move from one to the other. It closes with a decision guide and answers to common questions.

What a SOC 2 Type 1 report covers

A Type 1 report describes your system and gives the auditor's opinion on whether your controls are suitably designed as of a specific date. BARR Advisory describes it as an opinion over "the suitability of the design of controls at the service organization at a specific point in time." Linford & Co. notes that a Type 1 is "dated as of a particular date," and Schellman frames it as an evaluation of how well controls are designed and how they have been implemented as of a single report date.

In practice, a Type 1 answers one question: on this day, did the company have the right controls in place, and were they designed in a way that could meet the applicable criteria? It does not tell a reader whether those controls kept working the following week or month.

Because there is no observation window, a Type 1 can be completed soon after a company finishes implementing its controls. Schellman lists situations where a Type 1 makes sense, including recently implemented controls, organizations that need faster results, and teams using it as a preliminary step before a Type 2.

What a SOC 2 Type 2 report covers

A Type 2 report includes everything in a Type 1 and adds an opinion on whether the controls operated effectively throughout a defined period. In BARR Advisory's wording, it covers "the suitability of the design of controls at the service organization and the operating effectiveness of the controls throughout a specified period of time."

That period is often called the observation window or review period. Schellman states that Type 2 periods can run "anywhere from 3 months (often times for first-time reports) to 12 months (typical recurring cadence)." Linford & Co. says periods are commonly 6, 9, or 12 months, with 12 months being common. First-time Type 2 reports frequently use a shorter window of three to six months so the company can get a report into buyers' hands sooner, then shift to a 12-month cycle.

Linford & Co. describes the main sections of a Type 2 report: the service auditor's report (the opinion), management's assertion, the system description, and the tests of controls with results. Security reviewers often read that last section closely, since it lists each control, how it was tested, and any exceptions.

What auditors test in each report

For both report types, the auditor reviews your system description and maps your controls to the Trust Services Criteria you have put in scope. Security is always included; availability, confidentiality, processing integrity, and privacy are optional.

For a Type 1, the work centers on design and implementation. The auditor reads policies, walks through processes with control owners, and inspects evidence that each control exists as of the report date, such as a configured MFA policy, an approved incident response plan, or a completed risk assessment.

For a Type 2, the auditor also tests operation across the whole period. Linford & Co. lists the procedures auditors use: inquiry, observation, inspection of evidence, reperformance, and computer-assisted audit techniques. It cites the AICPA position that "inquiry alone does not provide sufficient appropriate evidence of the operating effectiveness of controls," so interviews must be backed by evidence. Linford & Co. also notes that auditors select samples across the period under review, and that an automated control may be tested once through reperformance while a manual control is tested against a sample of the population.

This is why Type 2 preparation depends on consistent record keeping. If quarterly access reviews are a control, the auditor will ask for each review in the window. If new hires must complete security training, the auditor will pick a sample of hires and look for completion records.

Type 1 and Type 2 side by side

The core distinction is the time frame. A Type 1 looks at a single date, while a Type 2 looks at a span of months. A Type 1 asks whether controls are designed correctly; a Type 2 also asks whether they worked consistently.

On testing depth, a Type 1 confirms that controls exist and are designed to meet the criteria. A Type 2 adds sampling across the period and reports the results of each test, including any exceptions. On evidence, a Type 1 needs proof that controls are in place on the report date, while a Type 2 needs a trail of records showing each control ran as often as it was supposed to.

On timing, a Type 1 can be issued within weeks of fieldwork once controls are in place. A Type 2 cannot be issued until the observation window closes, and Linford & Co. says the report is generally available within a month or two after the period end date. On cost, Type 1 engagements are generally smaller in scope and fee; Schellman notes that Type 2 requires more investment from both your staff and your auditors, which raises effort and fees.

On buyer perception, a Type 1 shows that a company has designed a control environment. A Type 2 shows that the environment has operated over time, which is what many procurement and security teams ask for. MACPAS describes Type 2 as often required in industries with higher security expectations, including SaaS, healthcare, financial services, and cloud computing.

Cost and timeline differences

Published cost figures vary by source, so separate auditor fees from total program costs such as tooling, readiness work, penetration testing, and staff time.

Linford & Co., an audit firm, states that a SOC 2 audit costs on average $20,000 to $100,000 depending on scope and other factors, and gives the same range for Type 2 reports specifically. Scrut, a compliance software provider, publishes separate ranges: a Type 1 typically costs between $15,000 and $40,000 all-in, and a Type 2 between $30,000 and $80,000, with Big Four engagements potentially higher. For US auditor fees alone, Scrut lists $5,000 to $25,000 for a Type 1 and $7,000 to $50,000 for a Type 2. Treat these as ranges to test against real quotes, since scope, company size, number of criteria, and firm choice all move the price.

Timelines differ more predictably. A Type 1 depends mostly on how long it takes to design and implement controls, followed by fieldwork and report writing. A Type 2 adds the observation window on top. Scrut states the minimum observation period is three months and that six months is a common recommendation. Linford & Co. says Type 2 fieldwork can take a few weeks depending on complexity, with the report typically issued a month or two after the period ends. A first Type 2 with a three-month window can therefore take roughly five to six months from window start to report in hand, before counting readiness work.

When customers accept a Type 1

A Type 1 is often accepted as an interim answer, especially from early-stage vendors. MACPAS describes Type 1 reports as useful for satisfying initial customer concerns or vendor risk reviews, and Schellman calls a Type 1 a handy substitute in the short term when timelines are tight.

Acceptance depends on the buyer. Smaller customers and teams running lightweight vendor reviews may accept a Type 1 paired with a stated date for a Type 2. Larger enterprises, regulated buyers, and customers whose own auditors review their vendors more often require a Type 2, because they need evidence that controls operated over time.

The way to find out is to ask. Before choosing, check with the prospects driving the request whether a Type 1 would unblock the deal, and whether they would want a committed Type 2 timeline in the contract or security addendum. Some buyers will accept a Type 1 now with a Type 2 due within a set number of months.

Moving from Type 1 to Type 2, bridge letters, and renewal

Schellman describes a common progression: readiness assessment, then a Type 1, then a Type 2 covering 3 to 12 months, then annual examinations. Many companies start the Type 2 observation window on or soon after the Type 1 report date, so the design work already reviewed carries directly into the operating period. Controls added or changed after the Type 1 need to be in place from the start of the window.

SOC 2 reports do not carry an expiration date, but buyers treat them as current for about a year. BARR Advisory says a SOC 2 report remains valid for one year following issuance, and Linford & Co. says the expectation is that a report be reproduced annually so there is no gap between reporting periods. That is why many companies settle into back-to-back 12-month Type 2 periods.

When a gap does occur, companies often issue a bridge letter, also called a gap letter. IS Partners and Secureframe both state that management writes and signs the bridge letter, not the auditor, and Lars Co. notes that it carries no assurance from the service auditor. It typically names the prior report period and CPA firm, states whether there have been material changes to controls, and includes a disclaimer that it does not replace a full report. IS Partners says a bridge letter should never exceed three months.

A decision guide

Start with the demand. If a specific customer or prospect has asked for a SOC 2 report, find out whether they require a Type 2 or would accept a Type 1 with a Type 2 date. Their answer often settles the question.

Consider a Type 1 first if you need a report within a few months, your controls are new or still being finalized, and your buyers accept design-only assurance for now. A Type 1 also gives you auditor feedback on control design before an observation window begins, which can reduce the chance of exceptions later.

Consider going directly to a Type 2 if your target customers are enterprises or regulated organizations that require it, your controls are already operating and producing evidence, or you would rather pay for one engagement than two. A short first window of three to six months can keep the timeline manageable.

Either way, plan the observation window deliberately. Choose a start date when controls are running consistently, confirm evidence is being retained for each recurring control, and align the period end with when you need the report. Compliance automation platforms can help by collecting evidence continuously across the window; Scytale, for example, connects to around 150 integrations and uses its Scy AI agent to assist with evidence collection, with a dedicated GRC expert included in the subscription. Get quotes for both paths to compare total cost and time to a first Type 2.

Frequently asked questions