SOC 2 Type 1 vs Type 2: which report your customer actually needs
A customer questionnaire or contract clause asks for a SOC 2 report by a fixed date, and the first decision is which report to provide. A SOC 2 Type 1 report covers the service organization's system description and the CPA firm's opinion on whether the controls are suitably designed as of a specified date. A Type 2 report contains the same opinions and adds an opinion on whether those controls operated effectively throughout a specified period, along with the service auditor's tests and their results. The right choice depends on three things: what the customer's contract or vendor review actually asks for, how soon a report is needed, and how mature your controls are. Read the request closely. Many customers name the report type, and some accept a Type 1 only as a stepping stone to a Type 2.
Cost and timing follow from that choice. The U.S. Department of Justice's October 2024 regulatory analysis (89 FR 86116) cited published estimates of $5,000 to $25,000 for a Type 1 audit and $30,000 to $100,000 for a Type 2. Treat these as published third-party estimates, not as a price for your engagement. The CPA firm's written quote, based on your system, scope and categories, governs. Ask each firm to separate the examination fee from any readiness or remediation work, and to state whether the Type 2 observation period is included or billed separately. Your own costs also differ: a Type 1 needs controls designed and in place, while a Type 2 needs them to keep running, with evidence, for the whole period. Confirm the observation period with the CPA firm before you commit to a customer date, since the report cannot be issued until that period has ended.
Organizations own their controls and the decision about which report to pursue. DeployOpen, where engaged, prepares systems, configurations and evidence so that controls can be shown to an auditor, under a fixed scope agreed in writing. DeployOpen does not issue audit reports, attestations or certifications. Only an independent CPA firm can examine your controls and issue a SOC 2 report, so ask any preparation partner to confirm in writing that it will not perform the examination. Before you choose, confirm three things with your customer: the exact report type and period they accept, the date they need it by, and whether a bridge letter would cover the gap between the report period and their request.
How the two SOC 2 report types compare
This table compares a Type 1 and a Type 2 SOC 2 report on the point or period covered, the opinions given, what the report contains and what a reader can rely on. Read the rows top to bottom, then use the cost and choice rows to see where each report fits. The main takeaway is that Type 2 tests operation over time, so it gives more assurance but takes longer to produce.
| Dimension | SOC 2 Type 1 | SOC 2 Type 2 |
|---|---|---|
| Point or period covered | A specified date | A specified period, set with the CPA firm |
| Opinions given | Description fairly presented and controls suitably designed as of the date | The same opinions, plus controls operated effectively throughout the period |
| What the report contains | System description, CPA opinion on design | Management's assertion, system description, service auditor's report, tests of controls and results |
| What a reader can rely on | That controls were designed to meet the criteria on that date | That controls were designed and actually operated over the period tested |
| Minimum period | Not applicable | No generally accepted minimum; the CPA firm sets a period long enough to opine on operation |
| Published cost estimate | $5,000 to $25,000 for the audit (DOJ 2024 rule, citing published estimates) | $30,000 to $100,000 for the audit (DOJ 2024 rule, citing published estimates) |
| Common reason to choose | A first report, a fast answer for a customer, or readiness before a longer period | Customers or regulated buyers that need evidence controls work over time |
| Ask the CPA firm for | Fees, scope, timing and the date the report will cover | Fees, the proposed period, sampling approach and the expected number of exceptions handling |
What a SOC 2 Type 1 and Type 2 report contains
A SOC 2 report starts with management's assertion, the written statement in which the service organization says its description of the system is fairly presented and its controls meet the Trust Services Criteria. The description of the system follows, prepared against the AICPA's 2018 description criteria (DC 200), which set out what the description must disclose: the services, infrastructure, software, people, procedures, data and the controls that apply. The service auditor's report then gives the opinion. A Type 1 report contains these parts with an opinion on whether the description is fairly presented and whether the controls are suitably designed as of a specified date. Nothing in it shows that the controls ran over time.
A Type 2 report keeps the same description and opinions and adds two things: an opinion on whether the controls operated effectively throughout a specified period, and a section describing the service auditor's tests of controls and their results. That test section is the reason a Type 2 is the document that shows operation. A reader can see which controls were sampled, what was tested and whether any exceptions were found. The AICPA's illustrative Type 2 report follows this structure, so reviewers can check a vendor's report against it. Confirm with your auditor how the test results will be presented for each criterion before fieldwork begins, since that affects how much detail a customer's reviewer will see.
Both report types rest on an attestation under AT-C section 205 of the AICPA attestation standards, so management must give the service auditor written representations in both cases. The AICPA publishes separate illustrative representation letters for Type 1 and Type 2 examinations, and the letter for Type 2 is longer because it covers the whole period. Before you commit to either report, ask your CPA firm which representation letter template it will use and what management must confirm, including that the description is complete and that known control deviations have been disclosed. Those statements are management's responsibility, so the people who sign them need to read the description first.
What customers can rely on from each report
When a prospect asks for a SOC 2 before a deadline, a Type 1 report can show that management described the system and that the controls were suitably designed on a specific date. It does not show that those controls ran consistently over time, so the customer learns what exists on that day, not how it behaved in the months before. Many buyers accept a Type 1 as an interim step, but whether they do is a decision only the customer can make.
- What a Type 1 proves: the system description was fairly presented and the controls were designed to meet the criteria as of one date.
- What a Type 1 does not prove: that controls operated effectively across a period, or that staff followed them day to day.
- What a Type 2 adds: an opinion on operating effectiveness over a stated period, plus the service auditor's tests and results.
- What prospects often ask for instead: a bridge letter, a timeline to the Type 2 period, or a copy of the policies and control matrix.
- What to check: ask the prospect in writing whether a Type 1 meets their vendor review, and confirm which report date and scope they need.
Banks and enterprise customers reviewing a vendor usually look for the report that covers the most recent period, and they read the exceptions as closely as the opinion. A Type 2 report gives them evidence that controls operated across a window, and the tests and results show how the auditor sampled and what deviations occurred. A Type 1 generally will not satisfy a recurring review on its own because it does not cover operation over time.
- What a Type 2 gives the reviewer: the period covered, management's assertion, the system description, and the auditor's testing of each control.
- Exceptions: deviations the auditor found are reported in the results, and reviewers commonly ask how the vendor responded.
- Bridge letters: when the latest period has ended but a new report is not yet issued, customers often request a management statement covering the gap.
- Subservice organizations: reviewers may ask whether cloud or hosting providers are carved out, and whether those providers' own reports were reviewed.
- What to confirm: the report date, period and scope each reviewer requires, and whether they accept a bridge letter in place of a current report.
Regulated customers that process sensitive data often need evidence that controls held across many months, not just at a point in time. A Type 2 report provides that evidence for the period it covers, and a series of consecutive Type 2 reports lets the customer see continuity. The Justice Department's October 2024 regulatory analysis, citing a vendor view, said Type 2 suits firms that regularly process highly sensitive personal data, but that is a commentary in a rule, not a requirement that customers apply.
- Continuity: consecutive periods show whether controls were maintained through change, staff turnover and platform updates.
- Management changes: material changes to systems or scope may need to be disclosed in the system description.
- Incidents: reviewers may ask how security events during the period were handled and whether any appear as exceptions.
- Scope drift: customers may ask whether categories or services added later are covered by the report.
- What to confirm: the regulator's or customer's own rules on report type, minimum period and reporting cadence, in writing, before the first engagement.
Customers rarely state their acceptance rules in plain language, so the safest approach is to ask before scoping the examination. The answers decide whether a Type 1, a Type 2, or a Type 1 followed by a Type 2 fits the deal. Put the questions to the customer in writing and keep the answers with the contract file, because an assessor or a later reviewer may ask what was agreed.
- Report type: whether a Type 1, a Type 2, or both is acceptable, and for which services.
- Period and date: the required report date or the minimum observation period and how recent it must be.
- Exceptions review: whether the customer will read exceptions and how they expect them to be explained.
- Interim evidence: whether a bridge letter, policies, a control matrix or a penetration test report is accepted in the meantime.
- Report access: whether the customer needs the full restricted report or only a general use SOC 3, which is a different document.
Illustrative example: a bank may accept a Type 1 for onboarding and then request a Type 2 at the next review. Confirm each customer's version of this sequence in writing.
What makes a Type 2 cost more than a Type 1
A Type 1 tests whether controls are designed correctly on one date, while a Type 2 tests whether they ran consistently across a period. The six drivers below explain where the extra money and effort go, and each one should appear in the CPA firm's written scope before work starts.
Observation period length and frequency
A Type 2 covers a specified period, and the auditor must see controls operate throughout it. Longer periods and controls that run frequently, such as daily log reviews or weekly backups, produce more instances for the auditor to sample and more evidence for you to collect. Ask the CPA firm how many instances it will sample for each control frequency and how the period start and end dates are set. The AICPA does not set a minimum period, so confirm the length the firm considers sufficient for your system.
Number of controls and systems in scope
Every control in your matrix is a test the auditor must perform across the whole period, and every system that holds or processes in-scope data adds tickets, logs and access records to review. Trim the scope to the services customers actually rely on before the period opens. Ask the firm to list the systems, the controls it will test and the evidence it expects for each, so you can see where the hours go.
Trust Services Criteria categories added to security
Security is required in every SOC 2 and applies the common criteria CC1 to CC9. Each added category, such as availability, confidentiality, processing integrity or privacy, brings its own criteria and its own testing. Privacy alone contains eight criteria series, P1 to P8. Decide which categories your contracts require, not which sound useful, and ask the firm to price each category as a separate line in the quote.
Locations and subservice organizations
Each office, data center or region in scope adds walkthroughs and sampling. Each subservice organization, such as a cloud provider, is handled either inclusively or as a carve-out, and the choice changes how much testing and vendor evidence the auditor needs. Ask whether carved-out providers will be covered by their own SOC reports, and whether the firm expects bridge coverage for any gaps in those reports.
Evidence maturity and remediation before the period
Controls that are written, owned and evidenced consistently from the first day of the period cost less to test than controls that are fixed midway through. Each exception found during fieldwork can lead to additional sampling or a qualified opinion. Before the period starts, run a readiness review, close the design gaps, and set up recurring evidence collection. Ask the readiness provider which gaps it expects to find and what remediation it estimates for each.
CPA firm fee and capacity
The CPA firm is the only party that can issue the report, so its fee is the largest single line item in most quotes. Fees vary with the firm's staffing, its experience with your kind of system, and how much it has to test. The Justice Department's October 2024 regulatory analysis cited published estimates of $5,000 to $25,000 for a Type 1 audit and $30,000 to $100,000 for a Type 2. Those are broad ranges from published sources, not a quote. The firm's written scope sets your actual fee, so request one in writing with the period, categories, locations and testing approach stated.
How the path from a Type 1 to a Type 2 runs
The sequence moves an organization from designed controls, to a documented point-in-time opinion, to a Type 2 opinion on controls that operated over a period. Each phase leaves a specific output the organization can show customers and the auditor.
Design and remediate the controls
Management defines the system boundary, maps its controls to the Trust Services Criteria in scope, and closes gaps where a control is missing or poorly designed. Management owns this work, and an implementation partner or consultant may help prepare it, but the controls belong to the organization. The output is a control matrix, written policies and procedures, and a system description draft that management is prepared to stand behind. The step is done when every in-scope criterion has a control that is designed to address it and management can explain how.
Fix the as-of date for the Type 1
Management and the CPA firm agree on a specified date on which the system description and control design will be assessed. On that date the controls must be in place as designed, because the Type 1 opinion speaks only to that point in time. The output is an agreed as-of date, a finalized system description, and management's written assertion. The step is done when the scope and date are confirmed in the engagement letter and the assertion is ready for signature.
Issue the Type 1 report
The CPA firm tests whether the description is fairly presented and whether the controls are suitably designed as of the agreed date, then obtains written representations from management. The firm issues a report containing the system description and an opinion on design. The output is a signed Type 1 report that shows the organization's controls existed and were designed to meet the criteria on that date. It does not show that the controls worked over time, and the organization should say so when sharing it.
Begin the Type 2 observation period
The Type 2 period starts after the Type 1 date, and the controls must run continuously throughout it without material change. Management and the CPA firm agree on the period length, which must be long enough for the auditor to opine on operating effectiveness. The output is a documented start date, a list of controls with their owners and frequencies, and a change record showing any control or system changes made during the period. The step is done when the period is formally set with the firm.
Collect evidence throughout the period
Control owners perform each control at its stated frequency and retain proof that it happened, such as access review sign-offs, change approvals, ticket records, scan results and training completion. Management checks evidence regularly so that gaps surface during the period rather than at fieldwork. The output is a complete, dated evidence set for every control across the observation window. The step is done when each control has evidence for each occurrence, and any exceptions are documented with their root cause and remediation.
Run Type 2 fieldwork and testing
After the period closes, the CPA firm samples occurrences of each control and tests whether each control operated as described. The firm also tests the description against what happened during the period and records exceptions. Management answers requests and supplies evidence, and the firm documents the tests and results. The output is the auditor's working papers, a list of exceptions if any, and management's response to each. The step is done when testing is complete and the firm has formed its opinion.
Receive the Type 2 report
The CPA firm issues the Type 2 report, which includes management's assertion, the system description, the auditor's opinion on design and operating effectiveness, and the tests performed with their results. Any exceptions appear in the report and affect the opinion. The output is a signed Type 2 report covering the full period, which the organization can share under the usual restrictions on a SOC 2 report. Readers should check the period dates and any exceptions before relying on it.
When starting with a Type 1 makes sense
A Type 1 is a sensible first report when a deadline arrives before a Type 2 observation period can finish. A Type 1 opines on the system description and on whether controls are suitably designed as of a specific date, so it can be issued once the controls exist and the description is accurate. That fits a new platform whose controls were only put in place recently, or a customer whose questionnaire is due before a useful operating history could exist. A Type 1 also suits a company that is still building its control set. Running a Type 1 first lets the team test the system description, the control matrix and the evidence the auditor asks for, and find gaps before the longer Type 2 period starts. Many teams treat the Type 1 as the readiness step it partly is, though they should confirm with their CPA firm that the timing is workable.
The risks are specific. A Type 1 does not show that controls operated during any period, so it says nothing about whether access reviews, change approvals or monitoring actually happened week to week. Some customers and banks will still require a Type 2 and may treat a Type 1 as incomplete. The most serious risk is a false sense of completion: a team that receives a Type 1 may stop investing in operating evidence, only to find the customer's vendor review rejects the report. Before choosing, ask the customer in writing whether a Type 1 meets their requirement, which report type and period they expect, the date by which a Type 2 must be delivered, and whether a bridge letter will be accepted in the interim. Also confirm the categories and system scope, since a mismatch on either will be discovered at review time, not at signing.
Who owns the controls, who prepares the evidence, and who issues the report
The service organization owns the system, its controls and the claims made about them. Management decides which services, locations and trust services categories are in scope, writes the description of the system, and signs the written assertion that the description is fairly presented and the controls are designed, and for a Type 2, operating effectively. Management also gives the CPA firm written representations during the examination, so the statements in those letters must be accurate and backed by records. Nothing a partner does changes this ownership.
- Controls and their owners: named people run each control, such as access reviews, change approvals and incident response, and can explain how it works.
- Management's description and assertion: the organization writes and signs the system description and the assertion that the CPA firm evaluates.
- Written representations: management confirms in writing what it told the auditor, including exceptions and known incidents.
- Policies and governance: leadership approves the policies that the controls implement.
Ask internally who will sign the assertion and representation letter, and confirm that person can defend every statement in them.
An implementation partner, such as DeployOpen for self-hosted open-source platforms, helps the organization plan, implement and document the technical controls, then prepares systems and evidence so the CPA firm can test them. This work is usually done inside the client's own cloud accounts, data centers or air-gapped networks. DeployOpen does not issue audit reports, attestations or certifications, and hiring a partner does not guarantee a result. The partner's output supports management's work and does not replace it.
- Planning and configuration: designing logging, access, backup and change controls on the platforms in scope.
- Documentation: writing runbooks, control descriptions and mapping to the Trust Services Criteria for management to review.
- Evidence preparation: setting up the systems so that configuration, access and change records can be exported for the auditor.
- Testing support: running security testing or readiness checks that management can use to remediate gaps.
- Handover: training internal staff so the organization can operate the controls during the observation period.
Before engaging a partner, confirm in writing that it will not sign the assertion, prepare the auditor's report or claim a certification on your behalf.
The independent CPA firm plans the examination under the AICPA attestation standards, tests the design of controls for a Type 1 and both design and operating effectiveness over a period for a Type 2, and issues the report. The firm must remain independent of the organization, which is why it generally should not design the controls it later tests. Only the CPA firm can issue the opinions, and the report it produces is the only document that carries its attestation.
- Examination planning: agreeing the scope, criteria and timing in an engagement letter before fieldwork starts.
- Testing: requesting evidence, sampling records and testing controls against the criteria chosen.
- Written representations: requesting the signed representation letter from management.
- Opinions and report: issuing the Type 1 or Type 2 report, including any exceptions.
- Independence: declining work that would impair objectivity, such as designing the controls it will test.
Ask the firm to confirm its licensing, peer review status and which preparatory work, if any, it is permitted to perform for you.
Questions buyers ask about SOC 2 Type 1 and Type 2
Can a SOC 2 Type 1 report be upgraded to a Type 2?
Not in the sense of converting an existing report. A Type 1 report opines only on the system description and whether controls were suitably designed as of one date, while a Type 2 adds an opinion on whether those controls operated effectively over a period. The CPA firm needs evidence from the operating period itself, so the organization usually runs the controls for the Type 2 window and the auditor tests them then. A Type 1 is still useful as a readiness step, because it shows the design holds up before the operating period begins. Ask the CPA firm how it will carry forward design work and what evidence it will need from the period you have not yet covered.
How long does a SOC 2 Type 2 observation period need to be?
There is no generally accepted minimum length for a Type 2 period. The period should be long enough for the service auditor to form an opinion on operating effectiveness, which is a judgment the CPA firm makes for your system, controls and evidence. Many buyers ask for a report covering a recent twelve-month window, but that expectation comes from customers and contracts rather than from the standard. Confirm with the CPA firm, before fieldwork starts, what period it will accept and how it will test controls that run less often than monthly.
Does a SOC 2 Type 1 cost less than a Type 2?
Usually, yes, but the CPA firm's written quote governs. The US Department of Justice's October 2024 regulatory analysis cited published estimates of $5,000 to $25,000 for a Type 1 audit and $30,000 to $100,000 for a Type 2, and those figures were the basis of its analysis rather than a price you can expect. The fee is only one part of the total. Readiness work, remediation, tooling, internal staff time and the cost of running controls across a longer period all add to the bill. A Type 2 generally requires more testing across the observation window, which is why its fee tends to be higher. Ask for the fee broken out by report type, sample sizes and what the quote excludes.
What does a SOC 2 require from our internal team?
Most of the effort falls on the people who run the system. Someone must own the control matrix, collect evidence on a schedule, and answer the auditor's requests for samples such as access reviews, change tickets and onboarding records. Engineering leaders must maintain the system description and confirm it matches production. Management must sign the written representations the CPA firm requests. For a Type 2, these tasks repeat through the whole observation period, so the workload is recurring rather than a one-time project. Ask your CPA firm for an evidence request list before the period begins so the team can plan its time.
Can we run a SOC 2 examination without outside help?
An organization can prepare for and undergo a SOC 2 examination with its own staff, provided the team understands the Trust Services Criteria, can design and document controls, and can produce consistent evidence. Outside help is commonly used for readiness assessment, gap remediation, and tooling setup, while the report itself must come from an independent CPA firm. The CPA firm that issues the report should not design the controls it tests, because that affects its independence. An implementation partner such as DeployOpen can prepare systems, controls and evidence inside your infrastructure, but it does not issue reports or attestations. Decide early which tasks your team will own and which external specialists you need.
Does a bridge letter cover the gap after a SOC 2 Type 2 report?
A bridge letter, also called a gap letter, is a statement from the service organization's management, not from the CPA firm, covering the time between the end of the last Type 2 period and a later date. It can reassure customers that management knows of no material changes in that gap. It does not replace the next Type 2 report, and it carries no CPA opinion. Customers often request one when a report is near the end of its currency. Ask your CPA firm whether it has guidance on wording, and confirm with your customers what they will accept.
Does a SOC 3 report replace a SOC 2 Type 1 or Type 2?
No. A SOC 3 covers the same Trust Services Categories as a SOC 2 in less detail, and it is a general use report that can be freely distributed, often published on a website. A SOC 2 is restricted in use and contains the system description, the auditor's tests and results for a Type 2. Customers doing vendor due diligence usually ask for the SOC 2 itself, under an NDA, because the detail is what they need to assess risk. Use a SOC 3 for public assurance, and expect to share the full SOC 2 report when a customer requests it.
How DeployOpen prepares your systems and evidence for a SOC 2 examination
DeployOpen prepares the self-hosted open-source systems and control evidence that a Type 1 or Type 2 examination will test, inside your own infrastructure. We do not issue reports or opinions; your independent CPA firm does, and your management owns the controls and the system description.
How we scope
- We agree the written scope with you before work starts, naming the systems, environments and locations covered.
- We confirm whether the engagement targets a Type 1 date or a Type 2 observation period, and the categories in scope.
- We identify which controls must already operate for the full period, so the Type 2 window is planned from the start.
How we build
- We configure self-hosted platforms so access, logging, change and monitoring controls run on defined, repeatable settings.
- We map each control to the relevant Trust Services Criteria and record the owner, frequency and evidence source.
- We document gaps and remediate them before the examination date or the start of the Type 2 period.
How we hand over
- You receive the control matrix, configuration baselines, runbooks and evidence collection procedures in writing.
- We prepare evidence packages the CPA firm can sample, showing what each control produced and when.
- We support management in drafting the system description inputs, but your management approves the final wording.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after the report is issued.
- We can help keep evidence flowing during the Type 2 period so operating effectiveness is demonstrable without last-minute collection.
- Questions about your CPA firm's testing requests are handled through your team, with the auditor's independence preserved.
