SOC 2 Type 1 vs Type 2
Type 1 addresses control design at a specified date. Type 2 also tests operating effectiveness throughout a stated observation period.
Ask the customer which report they accept. Do not infer observation length, delivery time, or price before a firm confirms the engagement.
Report comparison
| Field | Type 1 | Type 2 |
|---|
| Coverage | Design at a specified date | Design and operating effectiveness over a period |
| Evidence | Implementation evidence at the date | Samples across the observation period |
| Buyer use | May support an early-stage assurance request | Commonly requested for evidence that controls operated |
| Timing | No operating observation period | Observation period plus fieldwork and reporting |
| Price | Use current rate card or scoped quote | Network offer starts at $2,500; eligibility and scope apply |