"Do we need Type 1 or Type 2?" is one of the first questions every SOC 2 project starts with. The short answer: your customers decide, and most of them want Type 2. But there are good reasons to start with Type 1, and getting the order right can save you months.
What is a SOC 2 Type 1 report?
A SOC 2 Type 1 report is an auditor's opinion on whether your controls are suitably designed and in place on a specific date. The auditor reviews your system description and your controls, confirms they exist, and checks that they would meet the relevant Trust Services Criteria if they operate as described.
What a Type 1 does not do is test whether those controls actually worked over time. It's a snapshot.
What is a SOC 2 Type 2 report?
A SOC 2 Type 2 report covers the same design question, and then tests whether your controls operated effectively across a defined period, called the observation period. The auditor samples evidence from across that window: access reviews, change tickets, onboarding and offboarding records, incident logs and more.
Because it shows controls working in practice, a Type 2 carries much more weight with customers.
SOC 2 Type 1 vs Type 2 at a glance
| Type 1 | Type 2 | |
|---|---|---|
| What it tests | Design of controls on one date | Design and operating effectiveness over a period |
| Observation period | None | Usually 3 to 12 months |
| Typical total timeline | 3 to 4 months | 6 to 12 months |
| Evidence the auditor samples | Point-in-time | Across the whole period |
| What customers think of it | A good start | The standard most enterprises expect |
| Renewal | Usually replaced by a Type 2 | Renewed every year |
Which one do your customers want?
Ask them. Look at the security questionnaire or contract clause that triggered the request. If it says "SOC 2 Type 2" or "SOC 2 report covering at least six months", a Type 1 won't satisfy it, though it may keep the deal moving while your Type 2 is in progress.
In our experience:
- Large enterprises, banks and healthcare buyers almost always want Type 2.
- Mid-market buyers often accept a Type 1 for the first year if a Type 2 is underway.
- Some startups' first customers only need evidence that you take security seriously, and a Type 1 does the job.
When starting with Type 1 makes sense
- A deal is waiting. A Type 1 can be ready months before a Type 2.
- Your controls are new. If you have just put policies and tools in place, a Type 1 confirms the design before you start the clock on a Type 2.
- You want a dry run. The Type 1 audit shows you exactly what the auditor expects, so the Type 2 goes more smoothly.
When to go straight to Type 2
- Your customers have said Type 1 won't do.
- Your controls have already been running for a few months with good records.
- You want to avoid paying for two audits in the first year.
The common path: Type 1, then Type 2
Many companies get a Type 1, then start their Type 2 observation period the day after. A typical sequence looks like this:
- Readiness assessment and gap fixes (1 to 3 months). See our SOC 2 readiness assessment guide.
- Type 1 audit and report.
- Type 2 observation period (3 to 12 months; many first reports use 3 to 6 months).
- Type 2 audit and report, a few weeks after the period ends.
- Annual Type 2 renewals after that, with bridge letters to cover the gap between reports if customers ask.
For a full breakdown of what each stage costs, see our SOC 2 audit cost guide. For the Type 2 process in detail, read SOC 2 Type 2 audit: process, timeline and cost.
Mistakes we see
- Choosing Type 1 to save money, then needing Type 2 a few months later anyway. Check with customers first.
- Starting the observation period before controls are ready. Any control that fails during the period shows up as an exception in your Type 2.
- Picking the shortest possible period without asking customers. Some buyers want at least six months.