SOC 2 Type 1 vs Type 2: Which Report Enterprise Buyers Require

A buyer’s security team sends over a questionnaire, and somewhere near the top is a line that reads: “Please provide your most recent SOC 2 Type 2 report.” If you don’t have one, the next question in your head is usually whether a Type 1 would do, and how much faster you could get it.

Below: what each report actually tests, what they cost, how long they take, and which one the person on the other side of the deal is really asking for.

The short answer

A SOC 2 Type 1 report says your security controls were designed properly on one specific day. A SOC 2 Type 2 report says those controls actually worked over a period of time, usually three to twelve months.

Enterprise buyers want Type 2, because it’s the only one that shows your security is a habit, not a photo shoot. A Type 1 is useful when a deal needs paper soon and the buyer has said they’ll accept it. For most startups, the better plan is to go straight to Type 2.

If you’re new to SOC 2 entirely, start with our founder’s guide, What Even Is a SOC 2?, and come back here when you’re choosing between the two.

SOC 2 Type 1 vs Type 2 at a glance

	SOC 2 Type 1	SOC 2 Type 2
What the auditor checks	Are your controls suitably designed?	Are your controls designed and did they operate effectively?
Time covered	A single date (“as of June 30”)	A period, usually 3–12 months (“April 1 to September 30”)
How the auditor tests	Reviews policies and setup, checks each control once	Samples evidence across the whole period: tickets, access reviews, logs, change approvals
Auditor’s fee (audit only)	About $10,000–$30,000	About $30,000–$80,000+
Time to report	Weeks after you’re ready	The observation period plus a few weeks of fieldwork and reporting
What it proves to a buyer	You have a plan and the plan looks right	You follow the plan, month after month
What enterprise buyers ask for	Sometimes accepted as a stepping stone	The default ask
Best for	A near-term deal with a buyer who accepts it	Nearly every company selling to mid-market and enterprise

Auditor’s fee ranges are published industry estimates from Scrut for what a CPA firm charges to perform the audit. They don’t include getting ready for it: readiness work, compliance software, a pentest, or the people who run your program. Those are separate, and they depend on scope and how much you already have in place.

What is a SOC 2 Type 1 report?

A SOC 2 Type 1 is a CPA firm’s opinion on whether your security controls are suitably designed and in place as of a specific date. SOC 2 is an attestation under the AICPA’s standards (the SSAE 18 family), and the AICPA’s SOC 2 guide is the rulebook auditors follow. That’s also why only a licensed CPA firm can issue one, and why buyers increasingly check who signed it. Compliance platforms and consultants get you ready; they can’t sign the report.

Audit firm Johanson Group puts the formal definition plainly: a Type 1 is a report on “the fairness of the presentation of management’s description of the service organization’s system and the suitability of the design of the controls” (Johanson Group).

In practice, the auditor reads your policies, looks at how your systems are configured and checks that each control exists. Is multi-factor authentication turned on? Is there a written incident response plan? Does code need an approval before it ships? KirkpatrickPrice, another audit firm, describes it as an attestation “at a specific point in time” (KirkpatrickPrice).

What a Type 1 can’t tell anyone is whether those controls kept working the day after the auditor left. That’s the gap a buyer’s security team will notice.

What is a SOC 2 Type 2 report?

A SOC 2 Type 2, sometimes written SOC 2 Type II, covers everything a Type 1 does and adds a second question: did the controls operate effectively throughout a period of time? That period is called the observation window (auditors also call it the review or examination period).

Schellman, one of the largest SOC audit firms, describes a Type 2 as evaluating “the design and operating effectiveness of a company’s controls over a period of time.”

Instead of checking each control once, the auditor pulls samples from across the whole window. If your policy says access is reviewed every quarter, they’ll ask for the reviews. If every production change needs an approval, they’ll pick changes at random from month two and month five and look for the approvals. If someone left the company, they’ll check their access was removed on time.

That’s why Type 2 is the report procurement teams trust. It’s evidence of behavior, not intent. It’s also why logging and alerting matter so much: the auditor will sample them across the window, so they have to run every day, not just the week before fieldwork. Our monitoring and response team runs that layer for clients.

The real difference: a snapshot vs a track record

Here’s a way to think about it. A Type 1 is like a restaurant inspector visiting on a Tuesday morning after the kitchen has been scrubbed for the visit. A Type 2 is the inspector dropping in at random for six months.

Both have value. But if you were deciding where to send your company’s customer data, you’d want the second one. Your buyer feels the same way.

This also explains why Type 2 reports often include exceptions. Scrut defines an exception as “any instance where a control either was not designed correctly or failed to operate as intended during the audit period,” like an access review that ran a week late (Scrut). A few documented exceptions with a clear fix aren’t a red flag. They usually mean the auditor actually tested something. Only when problems are severe or widespread does the auditor issue a qualified opinion, and even then, as Linford & Co explains, a buyer judges it by whether the qualified area touches the service they’re buying.

A buyer who reads closely will trust a few honest, well-explained exceptions over a report that looks too good to be true. Jon makes the same case in Is Your SOC 2 Real? What Buyers Will Check Now, along with how buyers now verify the CPA firm that signed your report. If you want to see what that reader looks at first, our SOC 2 guide has a section on what’s inside the report.

Which one do enterprise buyers ask for?

If you’re selling to mid-market or enterprise companies, the answer is almost always Type 2. The audit firms say so themselves:

• “Many customers, prospects, partners, and user auditors prefer (or even require or request) a Type 2 report because it provides stronger assurance.” (Schellman)
• “At the end of the day, your customers are going to want a SOC 2 Type 2 report.” (Johanson Group)
• “Enterprise procurement teams overwhelmingly expect a SOC 2 Type 2 report.” (Drata)

Why buyers are pickier now

Buyers aren’t being difficult for fun. Vendors have become one of the main ways companies get breached:

• The share of breaches involving a third party doubled to 30% in a single year, according to Verizon’s 2025 Data Breach Investigations Report.
• SecurityScorecard found 35.5% of all breaches in 2024 were third-party related, and called that figure “likely conservative” (SecurityScorecard).
• IBM puts the average cost of a data breach for US companies at an all-time high of $10.22 million in 2025 (CyberScoop on IBM’s report).

So when a buyer’s security team reads your report, they’re asking one question: will this vendor still be doing this in month nine? A one-day snapshot can’t answer that. And security questionnaires remain the most common way companies assess vendors, used by 84% of organizations according to RiskRecon data compiled by Secureframe. A Type 2 report answers a big chunk of that questionnaire before it’s sent.

There are other reasons from the buyer’s side of the table, too:

• Their own auditors ask about you. Big companies have their own SOC 2 and ISO audits, and those auditors want to see that key vendors were tested over time.
• Their procurement checklist literally says “Type 2.” Often nobody on the buyer’s side has the authority to accept less without an exception from their CISO.

When a Type 1 will work

• The buyer has told you, in writing, that a Type 1 is acceptable for now. Some do, especially for smaller contracts, often on the condition that a Type 2 follows within a year.
• Your deal closes in the next few months and you can’t fit an observation window in. A Type 1 can show good faith while the Type 2 clock runs. Secureframe calls it “a short-term solution” (Secureframe).
• You’re early and selling to other startups. Smaller buyers sometimes care more that you’ve started than how far you’ve gotten.

Before you choose, ask the buyer. Johanson Group gives the same advice: “You should talk with your customers to see if this will meet their needs.” It takes one email and can save months. Something like:

“We’re starting our SOC 2 now. Would a Type 1 report plus a committed date for our Type 2 meet your requirements for this contract, or do you need the Type 2 before signing?”

If they say Type 2 only, you have your answer. If they say a Type 1 works, you’ve just bought time.

How long does each one take?

There are two clocks: getting ready (fixing gaps, writing policies, turning on controls) and the audit itself.

Type 1: Once your controls are in place, the audit itself can be quick. Secureframe says Type 1 audits and reports “can be completed in a matter of weeks.” Most of the time goes into getting ready.

Type 2: You need the same readiness work, plus the observation window, plus fieldwork and the final report after the window closes. Drata estimates 6–15 months end to end for a Type 2, compared with 3–6 months for a Type 1 (Drata).

How long does the observation window have to be? The AICPA doesn’t set a hard minimum for SOC 2. In practice:

• Three months is the shortest window most auditors and buyers will accept for a first Type 2. Schellman says periods run “anywhere from 3 months (often times for first-time reports) to 12 months.”
• Six months is common and reads as more mature. Johanson Group notes “some customers may require 6 months.”
• Twelve months is the norm once you’re renewing every year.

You can’t speed up the window itself. Three months of evidence takes three months. What you can speed up is everything around it: how quickly you get ready, and how cleanly your evidence comes together when the auditor asks. The free SOC 2 readiness checklist shows how far you are from starting that window in about four minutes.

A realistic Type 2 timeline

Phase	What happens	Typical time
Gap assessment and scoping	Pick the Trust Services Criteria, map what you have against what you need	1–2 weeks
Readiness	Write policies, turn on controls, set up evidence collection	A few weeks to a few months
Observation window	Controls run and evidence accumulates	3–12 months
Fieldwork and report	The auditor samples evidence and writes the report	A few weeks

When we took Augment Code through SOC 2 Type 2, it looked like this: two months to get ready, a three-month observation window, and their report in five months total, with zero audit deviations.

How much does each one cost?

The auditor’s fee is the number most articles quote, and it’s only one line of the bill. Here’s the full picture:

• The auditor’s fee: what the CPA firm charges to perform the audit and issue the report. Published estimates put it at roughly $10,000–$30,000 for a Type 1 and $30,000–$80,000+ for a Type 2, depending on scope and the firm (Scrut). Some auditors discount a Type 2 if you did your Type 1 with them, so ask.
• Readiness and running the program: scoping, policies, fixing gaps, setting up controls and collecting evidence through the window. This is separate from the audit fee, whether you do it in-house or bring in help, and it depends on how much needs to be built. Firms like ours don’t perform the audit: we run this part of the program. The auditor’s fee is separate, and we help you pick an auditor that’s right-sized for your stage.
• Compliance software: platforms like Vanta and Drata collect evidence and track controls. They help, but they don’t make judgment calls or answer your buyer’s questions.
• A penetration test: many buyers expect a recent third-party pentest alongside the report, and auditors often look at one as evidence of how you find and fix vulnerabilities. Our penetration testing team does these for startups, and we’ve written about where AI-driven pentesting does and doesn’t help. Jon’s Pentest Once a Year? covers what buyers will expect from that test in 2027.
• People time: this is the cost founders underestimate. Someone has to own the program, fix gaps, chase evidence and talk to the auditor. Often that’s your best engineer, pulled off the roadmap. We break down that trade-off in SOC 2 when you’re not ready to hire and in In-House, On-Demand, or YOLO?.
• Doing it twice: if you do a Type 1 now and a Type 2 later, you pay for two audits and repeat some of the preparation.

That last point is the main reason we usually recommend skipping Type 1.

Should you skip Type 1 and go straight to Type 2?

For most startups selling to enterprise, yes. Secureframe’s advice is the same: “If possible, we recommend going straight for the SOC 2 Type II report.”

The case for skipping Type 1:

• Your buyer wants Type 2 anyway. A Type 1 often just delays the conversation you’ll have to have in six months.
• You pay for one audit, not two.
• The Type 2 clock starts sooner. The readiness work is the same either way, so once controls are running you can begin the observation window right away.

The case for doing Type 1 first:

• A specific deal needs something on paper soon, and the buyer accepts Type 1.
• Your controls are brand new. Some argue a Type 1 is a useful dry run: “If the auditor finds a process that is poorly designed, you will have time to tighten up the process prior to your Type 2” (Security Boulevard).

The second argument is fair. But a proper readiness assessment gets you the same dry run without paying for a formal report. That’s the approach we usually recommend: find the gaps, fix them, start the window, get the Type 2.

What if your buyer needs something before your Type 2 is ready?

You have more options than you might think:

1. Share a readiness letter. A short letter from your security lead or compliance partner explaining where you are, when the observation window started and when the report is expected.
2. Answer their questionnaire well. A clear, honest, fast response often matters more to a security team than a PDF. Our Sales Support team does this every week, and our free Founder’s Security Cheat Sheet lists what enterprise buyers ask for, in order.
3. Offer a security call. Having someone who can speak as a peer to the buyer’s CISO builds trust quickly. This is a big part of what a vCISO does.
4. Publish a trust page. List your controls, policies and audit status so the buyer can see your progress without waiting on email.
5. Ask about a contract clause. Some buyers will sign with a commitment to deliver the Type 2 by a set date.

Read the scope, not just the type

Two Type 2 reports can cover very different things. Vendor-risk teams start with the auditor’s opinion (Bitsight’s vendor SOC 2 review guide says to “read it first”), then move to the exceptions and the scope. Before you share yours, check three details:

• Which Trust Services Criteria are in scope. Security is always included. Availability, Confidentiality, Processing Integrity and Privacy are optional, and buyers notice which ones you left out. Our SOC 2 guide walks through all five.
• Which vendors are carved out. Most startups run on AWS, GCP or Azure, and most reports use the carve-out method, meaning “the service organization explicitly excludes the subservice organization from the scope of its SOC report” (Compass IT Compliance). Buyers then look at your cloud provider’s own SOC 2.
• What the customer has to do themselves. Reports list complementary user entity controls (CUECs), the things your customer is responsible for, like managing their own users’ access. Keep that list short and sensible.

And if you’re using AI agents in your engineering workflow, expect auditors to ask how change management (control CC8.1) still holds. Paddy Roberts, who leads GRC at our client Augment Code, wrote up exactly how they handled it: Agentic Code Review and SOC 2 Type 2.

After your first Type 2: renewals and bridge letters

A SOC 2 report doesn’t technically expire, but buyers treat it like it does. “Many buyers establish policies such as requiring a report whose period ended within the prior 12 months,” as one analysis puts it, noting that’s “the buyer’s rule, not a universal SOC 2 validity period” (OneUptime).

That means most companies move to an annual cycle: one twelve-month observation window after another, with a new report each year.

Between the end of one window and the next report, buyers may ask for a bridge letter (also called a gap letter). It’s a short statement from your management, not the auditor, confirming nothing material has changed in your controls since the last period ended. According to BD Emerson, “up to three months of bridge coverage is routine and rarely questioned,” while three to six months draws scrutiny. Keep it accurate. It’s a representation your company is making, and buyers do read it. For the rest of what buyers ask once a new report lands, bridge letter included, see The Week After Your SOC 2 Report Lands.

How to choose: a simple decision guide

Go straight to Type 2 if:

• Your target customers are mid-market or enterprise.
• Your biggest deal is three or more months away, or the buyer will wait.
• You can have controls running in the next month or two.

Consider a Type 1 first if:

• A buyer has confirmed in writing that a Type 1 works for now.
• A deal you need closes before you could finish even a three-month window.
• You’re selling mostly to smaller companies that just want to see you’ve started.

Either way:

• Ask the buyer before you decide.
• Start your readiness work now. It’s the same for both.
• Plan for a Type 2 within 12 months. That’s where nearly every enterprise conversation ends up.

Prefer to listen? Jon and I covered SOC 2 alongside ISO 27001, NIST and PCI in The Founder’s Guide to Compliance, and Drata co-founder Daniel Marashlian describes hitting the SOC 2 wall as the first engineer at an ed-tech startup on episode 64.

The short answer to “Is a Type 1 good enough?”

Usually not for long. A SOC 2 Type 1 tells a buyer your security looks right on paper. A SOC 2 Type 2 tells them it worked, every week, for months. The second one is what closes enterprise deals.

If a deal is waiting on your SOC 2, the fastest path is rarely a shortcut. It’s getting ready quickly, starting the observation window as early as possible and keeping the buyer updated while the clock runs.

That’s the work we do at YSecurity. Our operators join your Slack, work in your cloud and codebase, and own the SOC 2 Type 2 program from gap assessment to final report. Our clients hold a 99% audit pass rate, and we bill in 15-minute increments with no retainers or minimums. Robust Intelligence finished their Type 2 with zero deviations and closed their acquisition by Cisco four months later. And when buyers start asking about your AI, the same team runs ISO 42001.

Is a deal waiting on your SOC 2? Book a free 15-minute call, or if you’re a startup, claim your first 8 hours free.

Download the SOC 2 readiness checklist (PDF)

The key controls auditors check across all 10 SOC 2 areas, the evidence they ask for, and how to score your readiness.

Download PDF