Start for free Start for free

SOC 2 Type 1 vs Type 2

A SOC 2 Type 1 report checks whether a vendor's security controls are well designed on a single date. A Type 2 report also tests whether those controls actually worked over a period of months, which makes it stronger evidence.

The short answer

Both are SOC 2 reports written by an independent auditor. Type 1 looks at one moment. Type 2 looks at a stretch of time and tests whether the controls really ran.

If you can choose, ask a vendor for a current Type 2.

Both types measure the same thing. SOC reports are assurance reports that CPAs provide under AICPA standards, and a SOC 2 covers controls for security, availability, processing integrity, confidentiality or privacy, measured against the "trust services criteria" (Journal of Accountancy). The difference is how deep the auditor goes.

SOC 2 Type 1

  • What it is: a report on whether the vendor's controls are suitably designed "as of a specified date" (Journal of Accountancy). A control is a safeguard such as access reviews, encryption or change approval.
  • What it does not show: whether those controls kept working after that date. EY says it looks at "a specific point in time."
  • When you see it: often from younger vendors on their first audit. Early-stage and mid-market buyers often accept a Type 1 plus a committed date for the Type 2.

SOC 2 Type 2

  • What it is: everything in a Type 1, plus an opinion on whether the controls actually worked throughout a specified period (Journal of Accountancy).
  • How long it covers: sources differ. The Journal of Accountancy says there is no generally accepted minimum, and EY says windows are "typically 3–12 months."
  • What else is inside: the auditor's tests and results, including any exceptions. An exception is a case where a control did not work as described.
  • Who asks for it: BD Emerson says enterprise security teams, banks and healthcare buyers usually require a current Type 2.

Which one applies to you

Use this order when you review a vendor's report. It works for a first review and for the yearly check at renewal.

  1. Ask for the latest Type 2. If the vendor only has a Type 1, ask when the Type 2 period started and when the report is due.
  2. Check the dates. A Type 2 covers a past period, so if it ended months ago, ask for a bridge letter that covers the gap.
  3. Read the scope. Make sure the product and features you use are in it.
  4. Read the exceptions in a Type 2 and the vendor's response to each.
  5. Read the complementary user entity controls. These are the steps the report expects you to take, such as managing your own user access.

A Type 1 is not a bad sign on its own. It tells you less, so weigh it against how much sensitive data you plan to send the vendor and how hard the vendor would be to replace.

Example

Venpo flagged a case where Insightly's new AI connector is not covered by its SOC 2 report. That is true whether a report is Type 1 or Type 2: the type tells you how deep the testing went, and the scope tells you what was tested.

For example, imagine a vendor sends a Type 1 dated last March and says a Type 2 is "in progress." You would ask for the Type 2 period dates and a written commitment to share the report when ready, and you might hold back your most sensitive data until then. You would also set a reminder to ask again when the promised date arrives.

How Venpo helps

A SOC 2 report is a look back. Venpo watches what comes next: it monitors your vendors' trust centers, DPAs, subprocessor lists and other public legal pages, and emails you a plain-English alert when they change, such as a new subprocessor or a new AI feature with different terms.

Start for free

Frequently asked questions

Is SOC 2 Type 2 better than Type 1?

It is stronger evidence, because the auditor tests whether the controls worked over time. A Type 1 only checks that they were designed well on one day.

How long is a SOC 2 Type 2 report valid?

It covers only its own review period, so the older that period is, the less it says about today. Ask for the latest report and a bridge letter for any gap since it ended.

Can I see a vendor's SOC 2 report?

You can ask the vendor for it. SOC 2 use is generally restricted, so vendors may share it only with customers or prospects, while a SOC 3 report is for general use.

Related terms

Security and Compliance SOC 2 SOC 2 is an independent audit report on a vendor's security controls, written by a CPA firm under AICPA standards. It shows what an auditor tested and found for specific systems over a specific period, not a blanket promise that your data is safe. Security and Compliance SOC 2 Report A SOC 2 report is the document a CPA firm issues after examining a vendor's controls. It holds the auditor's opinion, management's statement, a description of the system and, in a Type 2 report, the tests the auditor ran and what they found. Security and Compliance Bridge Letter A bridge letter is a short letter from a vendor's management covering the gap between the end of its last SOC report period and today. It says no material control changes are known, but no auditor has checked it. Security and Compliance SOC 2 Scope SOC 2 scope is the boundary of what a SOC 2 report covers: which products, systems, locations, legal entities, trust services categories and time period. Anything outside it was not examined, even if it carries the same brand. Comparisons SOC 2 vs ISO 27001 SOC 2 is a US audit report, written by a CPA firm, on how well a vendor's security controls are designed and run. ISO 27001 is an international certification that a vendor runs a managed security program. Both are useful, and SOC 2 gives you more detail to read. Comparisons SOC 1 vs SOC 2 A SOC 1 report covers a vendor's controls that can affect your financial reporting, such as payroll or billing processing. A SOC 2 report covers controls for security, availability, processing integrity, confidentiality and privacy. For most SaaS tools, SOC 2 is the one to ask for.

Sources

Last reviewed