SOC 2 Type I vs. Type II
SOC 2 Type I reports on control design at a point in time. Type II reports on operating effectiveness over a period, typically 3 to 12 months. Here's how to choose.
A SOC 2 Type I report evaluates whether a service organization's controls are well designed as of a specific date. A SOC 2 Type II report evaluates whether those controls worked effectively over a period, typically 3 to 12 months. Type II gives more assurance and is what most enterprise customers ask for. Type I is often a first step.
Side by side
| Type I | Type II | |
|---|---|---|
| Tests | Design of controls | Design and operating effectiveness |
| Timeframe | A single date | A period, typically 3 to 12 months |
| Evidence | Controls exist as described | Controls worked throughout the period |
| Auditor testing | Walkthroughs and inspection of one instance | Samples drawn from across the period |
| Time to first report | Weeks after you are ready | The observation period plus fieldwork |
| Typical use | First report, early customers | Enterprise customer requirement |
What SOC 2 is
SOC 2 is an attestation report issued by an independent CPA firm under standards from the American Institute of Certified Public Accountants (AICPA). It describes a service organization's system and gives the auditor's opinion on its controls against the Trust Services Criteria. There is no SOC 2 certificate. The report is the deliverable, and customers read it under NDA.
Every SOC 2 covers the Security criteria (also called the Common Criteria). You can add Availability, Processing Integrity, Confidentiality, and Privacy when they matter to your customers.
What the auditor does differently
For Type I, the auditor confirms that each control is described accurately and designed to meet the criteria, usually by walking through it and inspecting one example. For Type II, the auditor does that and then tests whether the control operated throughout the period. They pull samples: a set of new hires to check onboarding, a set of changes to check approvals, each quarter's access review, and so on. A control that worked in March and not in August produces an exception in the report.
Choosing between them
- Start with Type I if you need a report quickly for an early deal, your controls are new, or you want a low-stakes first pass with an auditor.
- Go straight to Type II if your target customers already ask for it, your controls have been running for a few months, or you'd rather not pay for two audits.
- Plan the Type II period early. The clock starts when your controls are in place. Starting a three-month period sooner gets you a report sooner.
A typical timeline
- ReadinessScope the system, pick the criteria, run a gap assessment, and fix the gaps. Often 1 to 3 months.
- Type I (optional)The auditor tests design as of one date. The report follows a few weeks after fieldwork.
- Observation periodControls run and evidence builds up. 3 months for a first Type II is common, and 12 months once you are established.
- FieldworkThe auditor samples evidence from across the period and interviews control owners.
- ReportThe final report, with any exceptions and your management responses.
- RenewMost companies run back-to-back 12-month periods so there is never a gap in coverage.
What it means for evidence
For Type II, evidence has to exist across the entire period. Collecting it continuously avoids gaps you can't fill after the fact.
The controls that most often cause exceptions are the recurring ones: quarterly access reviews that run late, offboarding that misses a system, changes deployed without a recorded approval, and vulnerability fixes that miss their deadline. Each of these can be checked automatically against your identity, code, and scanning tools, so you find the miss in week two of the period and not in fieldwork.
Reading a SOC 2 report you receive
If you are the customer, check the report type, the period and how recent it is, which Trust Services Criteria are covered, which systems are in scope, and whether subservice organizations like a cloud provider are carved out. Then read the exceptions and the complementary user entity controls (CUECs), the controls the vendor expects you to run. Ask for a bridge letter if the period ended more than a few months ago.
Common Type II exceptions, and how to avoid them
| Exception | Why it happens | How to prevent it |
|---|---|---|
| Late access reviews | Quarterly reviews slip during busy periods | Schedule them with owners and check completion automatically |
| Missed offboarding | An account in one app stays active after someone leaves | Connect HR to the identity provider and check for leftover accounts daily |
| Unapproved changes | Emergency fixes skip peer review | Enforce branch protection and document an emergency process |
| Overdue vulnerabilities | Critical findings miss the fix deadline | Track fixes against SLAs weekly and escalate before the deadline |
| Missing training records | New hires skip security training | Tie training to onboarding and check completion monthly |
Bridge letters
A bridge letter (or gap letter) is a short statement written by your own management, covering the time between the end of your last SOC 2 period and today. It says whether any significant changes to controls have happened. Customers ask for one when your latest report ended more than a few months ago. Keep it accurate: it is your company's representation.
What drives cost and effort
- The number of systems, locations, and teams in scope.
- Which Trust Services Criteria you include.
- The length of the observation period.
- How many gaps you start with.
- How much evidence has to be gathered by hand.
- Whether you add a second framework, like ISO 27001, in the same cycle.
How TruOps helps
TruOps pre-fills a SOC 2 readiness assessment from your documents, monitors technical controls on a schedule during the observation period, and keeps a dated evidence trail for each criterion. Failed checks become findings with a recommended fix, so gaps are closed before the auditor samples them. The same evidence maps to ISO 27001 and other frameworks.
What to look for
For Type II, what matters is having evidence for the whole period. Look for a tool that keeps collecting after your first report.
Questions
Should I start with Type I or Type II?
Many companies start with Type I to show progress quickly, then move to Type II. If customers require Type II, starting the observation period early matters more.
How long is a SOC 2 Type II period?
Anywhere from 3 to 12 months. First reports often use 3 to 6 months. After that, most companies move to 12-month periods that run back to back.
Is SOC 2 a certification?
No. SOC 2 is an attestation report from a CPA firm. People often say "SOC 2 certified," but there is no certificate, only the report and the auditor's opinion.
How long is a SOC 2 report valid?
A report covers its period and does not expire. In practice, customers expect a report whose period ended within the last 12 months, often with a bridge letter covering the time since.
What is the difference between SOC 1, SOC 2, and SOC 3?
SOC 1 covers controls relevant to customers' financial reporting. SOC 2 covers security and the other Trust Services Criteria, in a detailed report shared under NDA. SOC 3 covers the same criteria as SOC 2 in a short report you can publish.
Related
AICPA Trust Services Criteria: Type I and Type II readiness.
→Use casesSOC 2 readinessGo from documents to a SOC 2-ready program, with evidence attached.
→LearnCompliance evidenceWhat counts as good evidence, and how to keep it.
→LearnSOC 2 compliance guideTen steps from scoping to your first SOC 2 report.
→See it run on your own data.
Book 30 minutes with a GRC specialist. Bring a real document, like a SOC 2 report, risk register, or vendor list (redacted is fine), and we'll show TruOps AI working on it.