SOC 2 Type 1 vs Type 2

Type 1 addresses control design at a specified date. Type 2 also tests operating effectiveness throughout a stated observation period.

Ask the customer which report they accept. Do not infer observation length, delivery time, or price before a firm confirms the engagement.

Report comparison

FieldType 1Type 2
CoverageDesign at a specified dateDesign and operating effectiveness over a period
EvidenceImplementation evidence at the dateSamples across the observation period
Buyer useMay support an early-stage assurance requestCommonly requested for evidence that controls operated
TimingNo operating observation periodObservation period plus fieldwork and reporting
PriceUse current rate card or scoped quoteNetwork offer starts at $2,500; eligibility and scope apply