SOC 2 Type 1 vs Type 2: which to get for your first report

Every team preparing its first SOC 2 hits the same fork: Type 1 or Type 2? The names sound like versions, but they are two different kinds of report, and the choice affects your timeline, your budget and what your buyer will accept. This guide explains SOC 2 Type 1 vs Type 2 in plain terms and gives a simple way to decide.

The short answer

• A Type 1 report tells a reader that your controls are suitably designed, as of a specific date.
• A Type 2 report tells a reader that your controls are suitably designed and that they operated effectively over a period of time.

Both are issued by an independent licensed CPA firm under AICPA standards. Both are measured against the same Trust Services Criteria. The difference is time.

What each report tests

Type 1: design at a point in time

The auditor reads your system description, reviews your policies and controls, and checks that each control exists and is designed to meet the criteria as of one date. The auditor looks at evidence that the control is in place, but does not test whether it worked over months.

Type 2: design plus operation over a period

The auditor does everything in a Type 1, then tests whether the controls actually operated throughout an observation period. That means sampling: picking access reviews, change tickets, new hires and departures from across the period and checking each one against your stated process. The report lists the tests performed and the results, including any exceptions.

Side by side

| | Type 1 | Type 2 | |---|---|---| | Question answered | Are the controls designed properly? | Did the controls work over time? | | Time covered | One date | A period, usually three to twelve months | | Testing | Existence and design | Design plus samples across the period | | Time to first report | Shorter | Longer, because the period has to run | | Audit effort | Lower | Higher | | What buyers think | A credible first step | The standard many enterprise buyers ask for |

What the audit costs for each

Because a Type 2 involves more testing, it costs more. The platforms' own guides say so. Drata estimates the audit fee for a SOC 2 Type 1 at $7,500 to $15,000 and for a Type 2 at $12,000 to $20,000 for small to midsize companies, and puts the total first-year cost at $25,000 for a small startup (Drata, checked October 2, 2026).

At cybersoftware both audits sit inside a published price. The Type 1 examination comes with onboarding when you choose $4,000 one time instead of $2,000, with the CPA firm's fee included, or it can be added later for $2,000. For Type 2, your first SOC 2 Type 2 audit is included in the term, which is $600 a month on a 12-month term, with no separate auditor invoice.

How the observation period works

The observation period is the stretch of time a Type 2 report covers. Periods typically run three to twelve months. A shorter first period gets you a report sooner. A longer one gives buyers more confidence and is common once you are renewing every year.

A few rules of thumb:

• The period starts when your controls are in place, not when you sign up for anything.
• Evidence has to exist for the whole period. A quarterly access review you skipped in month two cannot be recreated later.
• Big system changes mid-period complicate testing. Plan migrations around the window where you can.

In cybersoftware, a Type 2 audit waits for a 3-month observation window to complete. For more on how the window works, see the SOC 2 observation period.

How to choose for your first report

Work through these questions in order.

1. What did your buyer ask for? If the security questionnaire or contract says Type 2, a Type 1 may not close the deal. Ask whether they will accept a Type 1 now with a Type 2 to follow.
2. When do you need a report? A Type 1 can be issued once controls are in place. A Type 2 cannot be issued until the observation period ends.
3. How mature are your controls? If you are still turning on MFA and writing policies, a Type 1 gives you a milestone while the period for a Type 2 runs.
4. What is your budget this year? A Type 1 audit costs less than a Type 2 by the platforms' own estimates.

For most small teams without a report, the common path is a Type 1 first, then a Type 2 covering the months after it. The Type 1 answers today's questionnaire. The Type 2 answers next year's.

Can you skip Type 1 and go straight to Type 2?

Yes. Nothing requires a Type 1 first. Teams that are already running mature controls, or whose buyers insist on Type 2, sometimes start the observation period straight away. The trade-off is that you have nothing to show until the period ends and the report is issued.

What stays the same across both

Whichever you choose, the preparation is largely the same work.

• A system description of your service.
• A set of approved policies.
• Controls in place and evidenced.
• An independent CPA firm to examine them.

That is why onboarding is the same for both. With cybersoftware, the choice of report type is a choice of entry. Onboarding alone is $2,000 one time and leads into Type 2. Onboarding with the Type 1 examination is $4,000 one time. Either way, Type 2 follows at $600 a month on a 12-month term, or $6,600 up front for the first 12 months. A first year comes to $9,200 all in, or $11,200 with Type 1. See our pricing page for the details. cybersoftware is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Frequently asked questions

Is a SOC 2 Type 1 worth getting if buyers want Type 2?

Often, yes. Many buyers accept a Type 1 as evidence of progress while the Type 2 period runs. Ask before you decide.

How long is a SOC 2 Type 2 observation period?

Typically three to twelve months. A first Type 2 often uses a shorter period so the report arrives sooner.

Does a Type 2 replace the Type 1?

Yes, in practice. Once you have a current Type 2, buyers rarely ask for the Type 1.

Is SOC 2 Type 1 vs Type 2 a question of pass or fail?

Neither report is a pass or fail grade. The CPA firm issues an opinion, and a Type 2 also lists the tests performed and any exceptions.

Start with a free readiness assessment. It takes about fifteen minutes and needs no card.