SOC 2
SOC 2 Type I vs Type II
One is a snapshot of design. One is a recording of operation. Which your customer is actually asking for, and what each demands from your team.
A SOC 2 Type I report evaluates whether your controls are suitably designed at a single point in time. A SOC 2 Type II report evaluates whether those same controls operated effectively across a defined period, commonly three to twelve months. Type I is a snapshot. Type II is a recording.
That difference sounds small and changes almost everything about your timeline, your evidence burden, and what your team has to do day to day.
The question each report answers
| Type I | Type II | |
|---|---|---|
| Question asked | Are the controls designed appropriately? | Did the controls actually operate? |
| Time covered | A specific date | A defined observation period |
| Evidence needed | That controls exist and are designed suitably | That controls ran consistently throughout the period |
| Typical use | Unblocking a deal while Type II runs | Ongoing enterprise vendor requirements |
| Failure mode | Controls exist on paper only | Controls lapse mid-period |
Why Type II is harder
Type I can, in principle, be reached by building the program and then being examined. Type II cannot be assembled retroactively. If your access review was supposed to happen quarterly and it did not happen in the second quarter, no amount of preparation at the end produces that evidence.
This is the practical reason a maintained program matters more than a well-designed one. Type II tests operation, and operation is a habit rather than a document.
Which one your customer wants
Ask them. This sounds obvious and is skipped constantly.
Some enterprise buyers accept a Type I with a committed date for a Type II, which unblocks a contract while the observation period runs. Others require Type II from the outset and will not move. Guessing wrong costs months in a direction you cannot recover.
If the requirement arrived through a procurement portal rather than a person, it is worth finding the person. Security review teams are usually more flexible than the form suggests, particularly when a company can show a credible program and a real date.
Choosing an observation period
Observation periods are commonly three, six, or twelve months. Shorter periods reach a report faster. Longer periods tend to carry more weight with sophisticated buyers, and they align more naturally with an annual reporting rhythm once you are on one.
A common sequence is a three-month initial Type II, then moving to an annual twelve-month period afterward. Whether that fits depends on your customer's requirement and how quickly your controls can be operating reliably.
What this means for your team
For a Type I, the work is concentrated: scope, build, document, be examined. For a Type II, the work is distributed across the period, and the risk shifts from building to sustaining.
The failure pattern is consistent. A company builds a strong program for the examination, the attention moves elsewhere, and three months into the observation period the quarterly reviews stop happening. The gap surfaces during the audit, when it is expensive.
This is precisely the work an outsourced compliance office exists to carry, and why we treat readiness and ongoing operation as one continuous engagement rather than two.
One thing neither report is
Neither is a certification. SOC 2 produces an attestation report from an independent licensed CPA firm describing what that firm examined and found. Companies are not SOC 2 certified, and a readiness provider cannot certify anyone. Anyone using that language is either careless or hoping you are.
Questions
Can we skip Type I and go straight to Type II?
Does a Type I expire?
How long is a typical observation period?
Who decides the observation period?
Does 22 issue these reports?
Next step
Deciding between Type I and Type II is a scoping conversation, not a research project. See how SOC 2 readiness works, or tell us which customer is asking.
Related reading
HITRUST
HITRUST e1 vs i1 vs r2: What's the Difference?
Three assessment paths, three different levels of assurance. What separates them, and what actually decides which one you start with.
HITRUST
HITRUST vs SOC 2: Which Does Your Company Need?
The answer is rarely about which framework is stronger. It is about what your buyers will accept, and whether you will eventually maintain both.
HITRUST
What Does Preparing for HITRUST Actually Involve?
Nine areas of work, and the one that decides whether the other eight hold together.