SOC 2 Type 1 vs Type 2: which one do you actually need?
Type 1 asks whether your controls are designed properly on a single date. Type 2 asks whether they actually operated over a period, usually three to twelve months, and the auditor samples evidence across that whole window.
Enterprise buyers generally want Type 2. Unless a specific deal is blocked right now and the customer has said a Type 1 is enough, go straight to Type 2 and pay one audit fee instead of two.
The two reports share a name, a framework and an auditor. They answer different questions, and buying the wrong one wastes a fee.
The difference in one table
| Type 1 | Type 2 | |
|---|---|---|
| Question it answers | Are the controls designed properly? | Did the controls actually work? |
| Time covered | A single date | A period, usually 3–12 months |
| How the auditor tests | Inspects the design | Samples evidence across the period |
| Typical audit fee | $7,000–$20,000 | $12,000–$40,000 |
| Time to obtain | Weeks after readiness | Readiness plus the observation window |
| What buyers want | Sometimes accepted as interim | What enterprise procurement actually asks for |
| Can it be rushed? | To a degree | No — the window is calendar time |
What a Type 1 actually is
A Type 1 is a photograph. On one specified date, an auditor examines your controls and gives an opinion on whether they are suitably designed to meet the Trust Services Criteria. Do you have an access control policy? Is MFA enforced? Is there a documented offboarding process?
What it does not say is whether any of it happened more than once. You can enforce MFA on Monday, be audited on Tuesday, and hold a clean Type 1 report on Wednesday. Sophisticated buyers know this, which is why a Type 1 rarely closes a deal on its own.
What a Type 2 actually is
A Type 2 is a film. The auditor picks an observation window — commonly three months for a first report, six or twelve thereafter — and tests whether controls operated effectively throughout it. They sample. If your policy says access is reviewed quarterly, they check that each quarter's review happened, was dated, and led to action.
This is why evidence cannot be manufactured at the end. A quarterly review dated the week before fieldwork tells the auditor the control did not operate during the period, and that is an exception in the report your customers will read.
Which one do you need?
In almost every case, the answer is whichever your customer will accept. SOC 2 is bought to unblock deals, so the deal decides.
Go straight to Type 2 if
- Nobody is blocking a contract on it this month.
- Your buyers are enterprises with a real vendor security review.
- You would rather pay one fee than two.
Do a Type 1 first if
- A specific deal is blocked now and the customer has said a Type 1 is enough to proceed while you work towards Type 2.
- Your board or an investor wants visible progress on a fixed date.
- You want an external check on your control design before committing to a 12-month window.
The common mistake is doing a Type 1 reflexively because it is cheaper and faster, then discovering the customer who asked always meant Type 2. You have then paid two audit fees and delayed the report that mattered. Ask the customer which one they accept before you scope anything.
How long each takes
For a startup starting from nothing:
- Readiness work: 1–3 months. Writing and approving policies, enforcing MFA, fixing offboarding, standing up the evidence you do not have.
- Type 1 fieldwork: 2–4 weeks after readiness, plus report drafting.
- Type 2 observation window: 3–12 months of calendar time that cannot be compressed, followed by fieldwork.
So a Type 1 is realistically 2–4 months away, and a first Type 2 is 6–12. The observation window is the reason to start now rather than when the deal appears: it is the one part no amount of money shortens. The full timeline is here.
What about the gap between reports?
A Type 2 covers a fixed period, and time passes after it. When a customer asks for coverage between your report's end date and today, the answer is a bridge letter (also called a gap letter) — a short statement from you, not the auditor, confirming no material changes to the control environment since the period ended. Auditors do not attest to bridge letters, and most buyers accept them for three months or so.
Does the report expire?
Not formally. A SOC 2 report covers the period it covers, and nothing invalidates it afterwards. In practice buyers stop accepting a report whose period ended more than twelve months ago, which is why the examination is repeated annually and why SOC 2 is a recurring cost rather than a one-off.
Questions people ask
What is the difference between SOC 2 Type 1 and Type 2?
A Type 1 report gives an opinion on whether controls are suitably designed at a single point in time. A Type 2 report gives an opinion on whether those controls operated effectively across a period, typically three to twelve months, and requires the auditor to sample evidence throughout that period.
Should a startup get SOC 2 Type 1 or Type 2 first?
Ask the customer who requested it. If nothing is blocked right now, go straight to Type 2 and pay one audit fee instead of two. Do a Type 1 first only when a specific deal is blocked today and the customer has confirmed a Type 1 is enough to proceed.
How long is the SOC 2 Type 2 observation period?
Commonly three months for a first report and six or twelve months for subsequent ones. It is calendar time and cannot be compressed, which is the main reason to begin readiness work before a customer asks.
Does a SOC 2 report expire?
There is no formal expiry. A report covers a stated period and remains valid for that period. In practice, buyers stop accepting reports whose period ended more than about twelve months ago, so the examination is repeated annually.
What is a SOC 2 bridge letter?
A short statement from the company, not the auditor, covering the gap between the end of the report period and today. It confirms there have been no material changes to the control environment. Auditors do not attest to bridge letters, and buyers typically accept them for around three months.
See this against your own company. SOC2Starter turns 19 questions into a personalised list of what you are missing, drafts the policies, and files the evidence against the requirement it proves. Fourteen days free, no card.