SOC 2 Type 1 vs Type 2: Key Differences

What does a SOC 2 Type 1 report actually test?

A Type 1 report is the assessor's opinion on whether your controls are suitably designed to meet the relevant Trust Services Criteria as of a specific date. Think of it as an architecture review: the assessor confirms that a control exists, is documented, and would achieve its objective if it operated as described. They inspect the design, not a track record.

Take CC6.1 (logical access). A Type 1 assessor confirms you have a policy requiring MFA and least privilege, that your identity provider is configured to enforce MFA, and that your access model maps roles to permissions. They verify the control is in place on the as-of date. What they do not do is pull a sample of the last two quarters of access grants to prove the control was enforced every time. That proof is a Type 2 exercise.

• Scope: design of controls at a single point in time (the 'as of' date).
• Evidence: policy documents, configuration screenshots, and a walkthrough of each control.
• Assessor opinion: are the controls suitably designed to meet the criteria?
• What it cannot tell a buyer: whether you followed those controls consistently.

What does a SOC 2 Type 2 report add?

A Type 2 report covers everything in a Type 1, then goes further: the assessor tests operating effectiveness across a defined observation period, commonly 3, 6, or 12 months. Instead of confirming a control exists, they sample instances over the window to prove it ran as intended each time it was supposed to.

This is where sampling drives the work. For quarterly access reviews, the assessor pulls the actual review records for each quarter in scope and checks they were completed and remediated. For joiner/mover/leaver, they sample employees who onboarded, changed roles, or left, and trace each one: was access provisioned on the right day, adjusted on a role change, and fully revoked at termination? Under CC7.4 (responding to identified security incidents), they test whether logged security events were triaged and handled per your process. A single leaver whose GitHub access lingered for 40 days becomes an exception in the report, visible to every buyer who reads it.

• Scope: design plus operating effectiveness over a period (3-12 months).
• Evidence: samples pulled across the window, not just current-state screenshots.
• Typical tests: quarterly access reviews, JML tickets, change management approvals, backup restores, log retention (e.g., 90 days), and encryption at rest (AES-256).
• Exceptions are disclosed: deviations from the stated control appear in the report for buyers to weigh.

Which report do buyers actually want?

In almost every enterprise procurement and vendor risk review, the answer is Type 2. A security team evaluating you as a subprocessor wants evidence that your controls held up over time, not a promise that they were configured correctly on one convenient afternoon. A Type 1 rarely clears a mature vendor risk questionnaire on its own.

The practical exception is timing. A prospect who needs assurance now, before your first Type 2 window has closed, may accept a current Type 1 as an interim signal, on the condition that a Type 2 is on the roadmap. Sales teams use this to unblock deals while the observation period runs. Treat it as a bridge, not a destination.

• Type 2 is the default expectation for enterprise deals and renewals.
• Type 1 can unblock an urgent deal as an interim artifact, provided Type 2 is committed.
• Buyers also read your CUECs (complementary user entity controls) to see what they must do on their side.
• A Type 2 with a few well-explained exceptions usually beats a spotless Type 1 in a buyer's eyes.

How much more do cost and time differ?

Type 1 is faster and cheaper because there is no observation window to sit through. Once your controls are designed and in place, an assessor can complete a Type 1 in a matter of weeks. Type 2 adds the calendar itself as the main cost: you cannot compress a 6-month observation period, and evidence must accrue across it.

The dominant expense in a Type 2 is not the assessor's fee, it is the operational discipline of running controls cleanly for months and collecting evidence continuously. A missed quarterly access review, or a change deployed without an approval ticket, becomes an exception you cannot retroactively fix. Most teams starting from scratch should plan several weeks of readiness work, then a 3-month minimum window for a first Type 2, with 6 or 12 months being common for renewals.

• Type 1: weeks to complete once controls are designed; lower assessor fee.
• Type 2: dominated by the observation window (3-12 months) plus continuous evidence collection.
• First Type 2 windows are often shortened to 3 months to get a report to market sooner.
• Renewals typically move to a 12-month period aligned to the prior report's end date to avoid coverage gaps.

When does starting with a Type 1 make sense?

Start with a Type 1 when you need proof of a credible control environment before a Type 2 window can realistically close, and a deal or funding milestone depends on it. It forces you to formalize policies, stand up MFA and least privilege, and document your joiner/mover/leaver process, which is exactly the groundwork a Type 2 requires anyway. The Type 1 becomes a dry run that de-risks the longer engagement.

Skip the Type 1 when you are not under time pressure. If no buyer is demanding assurance this quarter, spend the money going straight to Type 2, because that is the report you will ultimately need. Paying for both is only worth it when the interim Type 1 directly unlocks revenue or shortens a sales cycle.

• Good reasons: an urgent buyer, a funding gate, or a need to validate control design before committing to a window.
• Weak reasons: doing a Type 1 'to be safe' when no one is asking and you have runway to reach Type 2.
• Sequencing tip: schedule the Type 2 observation period to begin the day after the Type 1 date for continuous coverage.

What is a bridge letter and why do you need one?

A bridge letter (also called a gap letter) covers the period between the end of your Type 2 report and the date a buyer is evaluating you. A SOC 2 report is historical: a report ending March 31 says nothing about April through, say, an August review. The bridge letter, written by your management, attests that no material changes to your control environment have occurred in that gap and that controls continue to operate as described.

One limit matters: a bridge letter is your assertion, not the assessor's opinion. It carries less weight than the report itself and should cover only a short gap, typically no more than three months. If the gap stretches past a quarter, buyers will rightly ask for your next Type 2 rather than another bridge letter. Keep report periods contiguous and you minimize how often you lean on bridges at all.

• Purpose: attest that controls are unchanged between the report end date and today.
• Author: your management, not the assessor, so it is a self-attestation.
• Reasonable duration: up to about 3 months; longer gaps warrant a fresh report.
• Best practice: run back-to-back Type 2 periods so bridge letters stay short and rare.

SOC 2 Type 1 proves your controls are designed correctly at a point in time; Type 2 proves they operated effectively over a 3-12 month period via sampling. Enterprise buyers almost always want Type 2, so start there unless an urgent deal forces an interim Type 1, and use bridge letters only to cover short gaps between reports.