SOC 2 Type I vs Type II: Which One Do You Need

The detail below matters, because choosing wrongly costs months and sometimes the deal you were trying to protect.

The real difference, explained simply#

Imagine two ways of checking a restaurant kitchen.

In the first, an inspector visits on a Tuesday morning, looks at the fridges, the cleaning schedule and the staff training records, and confirms everything is properly set up. That is a Type I. It is a photograph.

In the second, the inspector reviews six months of temperature logs, cleaning records and training registers, samples them, and confirms the kitchen was run correctly throughout. That is a Type II. It is a film.

Both are useful. They answer different questions. Type I asks whether your controls are designed properly. Type II asks whether you actually operate them.

What the auditor actually tests#

This is where the practical difference becomes obvious, and it is worth understanding before you choose.

In a Type I, the auditor assesses design and implementation at a point in time. They read your policies, walk through each control with the people who run it, and confirm the control exists and would work if operated. Evidence is typically a current screenshot, a configuration setting, a policy document, a walkthrough.

In a Type II, the auditor assesses operating effectiveness across the whole period. They select samples from across that window and test them. If access reviews are quarterly and the period is twelve months, they will ask for all four and check each was completed, by whom, and what action followed. If onboarding requires security training, they will pick a sample of joiners from different months and ask for their training records.

That sampling approach is why gaps cannot be hidden. An auditor pulling five joiners at random across a year will find the two who never completed training. A Type I would never have surfaced it.

Why Type II is what buyers usually want#

Enterprise security teams have learned that good design proves very little. Any company can tidy up for one day. What they want to know is whether access reviews happened every quarter, whether alerts were investigated, whether leavers lost access promptly, month after month.

That is why a Type II report carries far more weight in a vendor review. It is also why many procurement teams specifically ask for Type II and will not accept a Type I as a substitute.

That said, a Type I is not worthless. It is genuinely useful when your controls are newly implemented and a customer needs evidence of progress before proceeding. It is a credible way of saying we have built this properly and the operating evidence is being collected now. Some buyers will accept it on the understanding that a Type II follows.

The observation window, and the part founders miss#

This is the single most important thing to understand about Type II.

A Type II report covers a period that has already passed. The auditor samples evidence from across that window. If your controls were sloppy in April, nothing you do in September repairs April. You cannot go back and re-run the period.

The practical consequence is that readiness work must finish before the window opens, not during it. Companies that start the clock and then begin fixing controls end up with exceptions in their report, which is worse than having no report at all, because the exceptions are visible to every customer who reads it.

How long should the window be? Three months is the usual minimum and a sensible choice for a first Type II, because it produces a report quickly and proves the model works. Six to twelve months is more common for established companies and carries more weight. Most organisations settle into an annual twelve month cycle after the first report.

A worked sequence#

For a company starting from a reasonable base, a realistic path looks like this.

Weeks 1 to 2. Scope the report: which systems, which Trust Services Criteria, which report type. Scope decisions made carelessly here are expensive to unwind later.

Weeks 2 to 6. Readiness assessment and remediation. Close the gaps, implement controls, write the policies, agree who owns each control and how often it runs.

Weeks 6 to 8. Operate everything for a short settling period. Confirm the evidence is actually being produced, that logs are retained, that reviews are being recorded.

Then the window opens. Three to twelve months of normal operation with disciplined evidence collection.

Final 4 to 8 weeks. Auditor fieldwork, sampling, queries, then the report.

The mistake is to compress the middle. Companies that open the window at week two, intending to fix controls as they go, are the ones that end up with exceptions.

What continuous evidence actually means#

The phrase sounds abstract. In practice it means a small number of recurring habits.

Quarterly access reviews, performed and recorded with evidence of what changed. Onboarding and offboarding checklists completed for every joiner and leaver, with dates. Change management records showing approvals before deployment. Vulnerability scan results and the remediation that followed. Incident records, including the ones that turned out to be nothing, because a register with no entries all year raises questions rather than confidence. Backup restoration tests actually performed, not merely scheduled. Vendor reviews for critical suppliers. Security training completion records.

The organisations that find renewals easy are those that treat these as routine operational tasks with owners and dates. The ones that scramble are those that treat evidence as something collected for the auditor at the end.

Common exceptions and how they arise#

An exception is the auditor's finding that a control did not operate as described during the period. They appear in the report. Customers read them.

The usual causes are mundane. An access review that was skipped in one quarter because the owner was on leave. A leaver whose accounts stayed active for several weeks. A change deployed without approval during an urgent fix. Security training that three joiners never completed. A backup test that was scheduled but never run.

None of these indicate a badly run company. They indicate a company without a named owner and a calendar for each recurring control. That is the entire difference between a clean report and one with exceptions.

If an exception does occur, context matters. A single isolated lapse with a documented root cause and corrective action reads very differently from a pattern. Being open about it with your auditor early is always better than hoping the sample misses it.

What each one costs and how long it takes#

Treat cost as two separate things: the readiness work that gets your controls and evidence in order, and the auditor's fee for the examination itself. They are always quoted separately, and they must be, because the firm that prepares you cannot be the firm that audits you.

Type I. Readiness is usually a matter of weeks once you start closing gaps, assuming you are not starting from zero. The examination itself is comparatively short, because the auditor is assessing design at a point in time.

Type II. Readiness is similar, but you then add the observation window, during which controls must demonstrably operate and evidence must be collected consistently. The examination is longer and more thorough because the auditor samples across the whole period. A first Type II typically runs six to twelve months end to end.

The cost drivers worth knowing: how many Trust Services Criteria you include, how many systems and environments are in scope, how mature your controls already are, how many people are involved, and whether your evidence is easy to retrieve or scattered across tools.

There are also costs that catch people out. SOC 2 expects annual penetration testing of your production environment and most audit firms want to see an independent report, which is a recurring line rather than a one-off. You may need tooling for logging, monitoring and evidence collection. And your own engineering time during remediation is usually the largest hidden cost of all, so plan for genuine senior involvement rather than assuming it can be absorbed.

Bridge letters, the thing nobody explains#

Here is a practical detail that saves awkward conversations with customers.

Your Type II report covers a fixed period, say January to December. In March of the following year a prospect asks for your current report. The report they receive ends in December, which leaves a gap of three months with no coverage.

A bridge letter, sometimes called a gap letter, is a short statement from your management confirming that no material changes to your controls occurred between the end of the report period and the date of the letter. It typically identifies the report and its period, states that controls have continued to operate, confirms no material changes or incidents affecting the control environment, and is signed by management.

Three things worth knowing. Bridge letters are written by you, not your auditor, and carry no audit assurance. They are generally accepted only for a short period, usually up to around three months. And they are only credible if true, so if something material did change, say so rather than signing a blanket statement.

How to decide, in practice#

Choose Type I if: a specific deal is blocked right now, your controls have only recently been implemented, or you need to show credible progress to a customer or investor quickly.

Choose Type II if: you have time before the customer requirement bites, your controls have already been operating for a while, or your buyers have explicitly said Type II.

Choose both, in sequence, if: a deal is waiting and you know enterprise customers are coming. Get the Type I to unblock the deal, start the observation window the same week, and convert to Type II.

The mistake to avoid is going straight to a Type II window before your controls are genuinely running. It feels faster. It is not.

After the first report#

SOC 2 is not a one-off. Reports cover a period, so a report with a period ending last year is of limited use to a buyer today. Most companies move to an annual cycle, with each report covering the twelve months since the last.

That changes how you should think about it. The goal is not to pass an audit once, it is to operate controls continuously and collect evidence as you go. Companies that treat evidence collection as a year-round habit find each renewal straightforward. Companies that scramble at the end repeat the pain annually and tend to accumulate exceptions.

It is also worth planning the calendar so your report period ends shortly before your busiest sales season, so prospects are always looking at recent coverage rather than a report nearing the end of its useful life.

If you also need ISO 27001#

Many Indian companies eventually need both: SOC 2 for US customers and ISO 27001 for European, Middle Eastern and enterprise buyers. The underlying control sets overlap heavily, particularly around access management, change management, risk assessment, vendor management and incident response.

Building them separately duplicates a great deal of work. If you expect to need both, design one control set and map it to both frameworks from the start. Our ISO 27001 consulting and SOC 2 readiness work are deliberately built to run that way, and our VAPT service covers the penetration testing both expect.

For the wider picture on what US customers check, our guide to SOC 2 for Indian SaaS covers scoping, the Trust Services Criteria and realistic timelines.

Frequently asked questions#

Conformite Assist is an independent compliance advisory, helping organisations across 13 regions and four continents get audit-ready since 2011. We prepare you. The independent licensed firm examines you and issues the report.

This article is for general information only and does not constitute legal, audit or accounting advice. Costs, timelines and observation windows vary with scope, auditor and complexity, and AICPA guidance evolves. Details are accurate to the best of our knowledge at the time of writing, November 2026.

Hero photograph: Cht Gsml, Unsplash.