Do I need Type 1 before Type 2?

It is not required. If your controls have been running consistently for a few months, you can go straight to Type 2 and save an audit. Type 1 makes sense when a deal is blocked right now and you have not yet built enough history for the observation period.

Does SOC 2 give you a certificate?

No. SOC 2 produces an audit report signed by an independent accounting firm, not a certificate like ISO 27001. It is a long document describing the system, the controls, the tests applied and any exceptions found. You share that report with customers, normally under a confidentiality agreement.

How long does a Type 2 take?

It depends on the observation period you choose. Three months is usually the shortest, and many companies start there to get the first report sooner, extending to twelve months at later renewals. Add preparation time before that period and report issuance after it.

What covers the gap between the period end and today?

A bridge letter, issued by your own company, stating that nothing material has changed in the controls since the end of the period covered by the report. It is the accepted practice for covering that interval while the next report is being produced, and it usually satisfies customer due diligence.

Trust and audit

SOC 2 Type 1 vs Type 2

The difference is time. Type 1 shows your controls were well designed on one specific date, like a snapshot. Type 2 follows those same controls over a period, usually three to twelve months, and proves they actually operate day to day. That is why buyers nearly always ask for Type 2 and treat Type 1 as a stepping stone.

Explore SOC 2 readiness Go to the comparison

In short

Type 1 assesses control design on a date. Type 2 assesses design and operation across a period.
SOC 2 is not a certificate: it is an audit report signed by an independent accounting firm.
Type 1 is faster and cheaper, but it is rarely what a customer accepts as the final answer.
Sitting on Type 1 for years draws the wrong kind of attention: it reads as a programme that exists on paper only.

Side by side

A snapshot against a film

What to compare	SOC 2 Type 1	SOC 2 Type 2
What the auditor assesses	Whether controls were well designed on a specific date.	Whether controls were well designed and operated across a period.
Period covered	A single day, the cut off date.	Usually three to twelve months of operation.
Evidence required	Policies, configurations and process design.	Samples of execution across the whole period, month by month.
Typical timeline	Shorter, because no observation window is needed.	Longer: the observed period plus the audit time.
Cost	Lower, with fewer audit hours.	Higher, because the auditor tests samples from the full period.
What the buyer thinks	Accepts it as a step, then asks when Type 2 arrives.	Closes the conversation in due diligence.
Renewal	Makes sense once, as a starting point.	Annual, so no gap opens between reports.
Best used for	Showing progress and unblocking deals while Type 2 matures.	Being the definitive proof that security works in the routine.

Both reports assess the same trust services criteria. Security is mandatory; availability, processing integrity, confidentiality and privacy come in depending on what you promise customers.

The snapshot of one day

SOC 2 Type 1

The auditor looks at your controls on a set date and answers one question: are they designed in a way that would work? It does not test whether they worked last month, because there is no observed period. It comes out faster, costs less and serves a company that needs something concrete now while building the history Type 2 will demand later.

Assesses control design on a date
Shorter timeline and lower cost
Good for unblocking a deal in the short term
A starting point, not a destination

The film of the period

SOC 2 Type 2

The auditor follows the same controls over months and tests samples: was that access really reviewed this quarter? was that alert really handled? was that backup really restored in the test? The report shows what worked and also what failed, with the explanation. That detail is what gives the document its weight and what stops your customer's procurement team asking follow up questions.

Assesses design and operation across the period
Tests real samples of execution, month by month
Shows exceptions too, with context
What buyer due diligence expects

How they fit together

Type 1 is a step, not an address

Plenty of companies run Type 1 first to have something in hand while the history builds, then follow with Type 2 covering the period that comes after. That sequence is legitimate and it works. The problem starts when Type 1 becomes a permanent address: the buyer notices two or three years have passed with no Type 2 and concludes the controls were never tested in practice. If the plan really is to stay on Type 1, it is better to say so and discuss a different route to proof.

Type 1 first, Type 2 for the following period, is a normal sequence
An annual Type 2 report avoids a gap between periods
Between the end of the period and today, a bridge letter covers the interval

Which case is yours

Where to start

A contract is blocked right now and you have no history

Run Type 1 and schedule Type 2

You show something concrete fast and signal to the customer that Type 2 already has a date.

Your controls have been running for a few months

Go straight to Type 2

If the history exists, skipping Type 1 saves an entire audit.

Your customer is a large or regulated company

Only Type 2 will do

That kind of due diligence asks about the period covered. A report with no period does not pass.

Numbers that matter

1 day

is what Type 1 covers

3 to 12 months

typical period observed in Type 2

Annual

expected Type 2 cadence, with no gap

How DM11 solves it

From the first report to Type 2 without the scramble

We organise the controls, prepare evidence the way the auditor wants it and track the observation period so nothing is missing when testing starts. You reach the audit without a rush and without discovering a hole in the final month.

Evidence is collected during the period, not in a panic the night before
We pick the criteria with you, so you do not pay for scope nobody asked for
A dry run before the audit: you learn where you are weak while there is still time
We stay for the annual renewal, so no gap opens between reports

Explore SOC 2 readiness

Common questions

What people ask before deciding

Answers checked against the AICPA trust services criteria and SOC 2 audit practice.

Type 1 assesses whether controls were well designed on a specific date, like a snapshot. Type 2 assesses whether those same controls operated across a period, usually three to twelve months, testing real samples of execution. Type 2 carries more weight because it proves routine, not intention.

Move past Type 1 and hand your customer the report they ask for

A short conversation shows which period makes sense for you and what needs to be ready first.

Talk to a specialist Explore SOC 2 readiness

SOC 2 Type 1 vs Type 2

What to compare

SOC 2 Type 1

SOC 2 Type 2

What the auditor assesses

Whether controls were well designed on a specific date.

Whether controls were well designed and operated across a period.

Period covered

A single day, the cut off date.

Usually three to twelve months of operation.

Evidence required

Policies, configurations and process design.

Samples of execution across the whole period, month by month.

Typical timeline

Shorter, because no observation window is needed.

Longer: the observed period plus the audit time.

Cost

Lower, with fewer audit hours.

Higher, because the auditor tests samples from the full period.

What the buyer thinks

Accepts it as a step, then asks when Type 2 arrives.

Closes the conversation in due diligence.

Renewal

Makes sense once, as a starting point.

Annual, so no gap opens between reports.

Best used for

Showing progress and unblocking deals while Type 2 matures.

Being the definitive proof that security works in the routine.

SOC 2 Type 1

Assesses control design on a date

Shorter timeline and lower cost

Good for unblocking a deal in the short term

A starting point, not a destination

SOC 2 Type 2

Assesses design and operation across the period

Tests real samples of execution, month by month

Shows exceptions too, with context

What buyer due diligence expects

Type 1 is a step, not an address

Type 1 first, Type 2 for the following period, is a normal sequence

An annual Type 2 report avoids a gap between periods

Between the end of the period and today, a bridge letter covers the interval

From the first report to Type 2 without the scramble

Evidence is collected during the period, not in a panic the night before

We pick the criteria with you, so you do not pay for scope nobody asked for

A dry run before the audit: you learn where you are weak while there is still time

We stay for the annual renewal, so no gap opens between reports