SOC 2 Type I: what it is and how it differs from Type II

What is SOC 2 Type I?

SOC 2 Type I is an audit report on whether a company’s security controls are suitably designed and in place on one specific date. It does not test whether they kept working over time; that is what Type II does.

It is also written SOC 2 Type 1. A SOC 2 Type I report is quicker to get and often serves as a first step towards Type II.

SOC 2 Type 1 vs Type 2

  • Type I: controls are designed and in place on a date. Type II: controls operated effectively across a period.
  • Type I: a snapshot. Type II: evidence sampled over months.
  • Type I: faster and cheaper. Type II: what most enterprise buyers ultimately want.

When to get SOC 2 Type I

When a customer needs assurance soon and will accept a Type I while a Type II is under way, or when you want an auditor’s view of your design before committing to an observation period. If your buyers insist on Type II, a Type I may only delay the report they actually need.

SOC 2 Type I timeline

Once controls and policies are in place, the audit itself typically takes a few weeks of fieldwork and reporting. Most of the time goes into preparation: writing policies, setting up access reviews and gathering evidence that each control exists.

Preparing for the audit

A readiness assessment before either type finds the gaps while fixing them is still cheap. Compliance as a Service for SMBs tracks SOC 2 controls, policies and evidence in one place, with a readiness score that moves as evidence lands.

Last reviewed 2026-11-01.

Related terms

  • SOC 2 Type II — SOC 2 Type II is an independent audit report, under the AICPA’s SOC 2 framework, on whether a company’s security controls actually operated effectively over a period of time, usually three to twelve months.
  • Readiness assessment — A readiness assessment is a rehearsal of an audit: a review of your controls, policies and evidence against a framework such as SOC 2, done before the real audit so gaps can be fixed while it is still cheap.
  • Control — A security control is a specific safeguard a company puts in place to manage a risk, such as revoking a leaver’s access within 24 hours, and that an auditor can ask you to prove is working.

All glossary terms →