SOC 2 comes up constantly in enterprise sales conversations — "do you have SOC 2?" is often one of the first security questions a prospective customer's procurement team asks. But SOC 2 Type I and Type II aren't a beginner/advanced pair of the same test; they answer genuinely different questions, and picking the wrong one first can waste months.
First: SOC 2 is an attestation, not a certification
This trips people up constantly. Unlike ISO 27001, there's no "SOC 2 certificate." SOC 2 is an attestation report issued by an independent CPA firm under AICPA standards (SSAE 18), describing your controls and the auditor's opinion on them. You don't "pass" SOC 2 in a pass/fail sense — you receive a report, and prospective customers read that report.
The five Trust Services Criteria
Both Type I and Type II are evaluated against the same five Trust Services Criteria, though only Security is mandatory:
- Security (mandatory) — protection against unauthorised access.
- Availability — systems are available for operation and use as committed.
- Processing Integrity — system processing is complete, valid, accurate, and timely.
- Confidentiality — information designated as confidential is protected.
- Privacy — personal information is collected, used, retained, and disposed of appropriately.
Most SaaS companies start with Security alone (sometimes called a "Security-only" SOC 2) and add Availability or Confidentiality later as customers specifically ask for them.
Type I: a point-in-time design assessment
A Type I report answers one question: "were these controls suitably designed as of a specific date?" The auditor reviews your control descriptions and confirms they're designed appropriately to meet the relevant criteria — but does not test whether they operated effectively over any period of time. It's a snapshot, not a track record.
Type II: operating effectiveness over time
A Type II report answers a harder question: "did these controls actually operate effectively over an observation period?" — typically anywhere from 3 to 12 months, with 6 or 12 months being the most common for a mature program. The auditor samples evidence throughout that window (access reviews that actually happened every month, incidents that were actually logged and resolved, etc.), not just at one point in time. This is the report most enterprise buyers actually want to see.
So which one do you need first?
In practice, most companies use Type I as a stepping stone, not an end goal:
- If you're early and customers are starting to ask about SOC 2, a Type I report lets you show real progress quickly — it can often be achieved in weeks once controls are designed, rather than waiting out a multi-month observation window.
- If a specific deal genuinely requires SOC 2 and there's time pressure, Type I buys credibility while your Type II observation period runs in parallel.
- If you have the runway, going straight for a Type II (usually with an initial shorter observation window, like 3 months, then extending in future cycles) avoids paying for two separate audits.
What you should avoid is treating Type I as a permanent substitute — sophisticated enterprise security teams know the difference, and a company that stays on Type I for multiple years without progressing to Type II can read as a red flag rather than reassurance.
What both reports actually require operationally
Regardless of type, the underlying work is the same: define your control environment, map it to the relevant Trust Services Criteria, and generate real evidence. Type II simply extends that evidence generation across the whole observation window instead of a single point in time — which is exactly where most companies underestimate the ongoing operational lift.
This guide is general information, not a substitute for advice from your auditor — the right choice between Type I and Type II depends on your specific sales cycle, customer base, and resourcing.
Keeping evidence current across the observation window
The hardest part of a Type II audit is almost never designing the controls — it's proving, month after month, that they actually ran. ComplianceDesk's SOC 2 framework maps the five Trust Services Criteria to pre-built controls, with an evidence vault to attach proof as it happens and reminders before a recurring control (like a quarterly access review) falls overdue — so your observation window builds a real, continuous record instead of a scramble right before the audit.