SOC 2 Type I vs Type II: which report do you need?

A SOC 2 Type I report tells a reader whether your controls were suitably designed and in place on one specific date. A Type II report answers the harder question: did those controls actually operate effectively, day after day, across an observation period. Both are issued by an independent CPA firm against the same AICPA criteria. The choice between them is mostly about timing and what your customers will accept.

What does each SOC 2 report cover?

A SOC 2 report describes your system and gives the auditor's opinion on your controls. The two types share the same structure and criteria. They differ in what the auditor tests.

A Type I report assesses controls at a specific point in time. It covers the fairness of your system description and whether the controls are suitably designed and implemented as of that date. It does not test whether the controls kept working afterwards.

A Type II report covers the same ground and then adds testing of operating effectiveness over a specified period. Microsoft's description of its own SOC 2 Type 2 report puts it plainly: the auditor evaluates whether controls are designed appropriately and were operating effectively over a specified time period (Microsoft Learn).

	Type I	Type II
Question answered	Are controls suitably designed and in place?	Did controls operate effectively over time?
Time covered	A single date	An observation period, often up to 12 months
Auditor testing	Design and implementation	Design, implementation and operating effectiveness
Evidence needed	Policies, configurations, a walkthrough of each control	Records showing each control ran throughout the period
Typical use	First report, near-term customer deadline	Ongoing assurance, renewals, most enterprise reviews
What it signals to buyers	The program exists	The program works

How long does a Type II observation period run?

The observation period is agreed between you and your auditor. A twelve-month period is typical for an established program (Cloud Security Alliance). Large cloud providers run rolling twelve-month periods: Microsoft and AWS both describe twelve-month SOC 2 periods with new reports issued twice a year (AWS).

First Type II reports often cover a shorter window, so you have a report in hand sooner and then move to an annual cycle. Your auditor and your customers set what is acceptable. Ask key customers what period length they will accept before you fix the dates.

Who can issue a SOC 2 report?

Only a licensed CPA firm can perform a SOC 2 examination and issue the report. The AICPA describes SOC as a suite of services that CPAs may provide on a service organization's controls, and it sets the professional standards for those engagements (AICPA & CIMA).

The examination is performed under the AICPA attestation standards in SSAE No. 18, specifically AT-C section 105, Concepts Common to All Attestation Engagements, and AT-C section 205, Examination Engagements. The auditor also follows the AICPA's SOC 2 guide, whose current edition was updated as of October 15, 2022 (AICPA & CIMA). Your system description is prepared against the 2018 SOC 2 Description Criteria, known as DC 200.

Compliance software vendors and readiness advisers cannot attest to your controls. The Journal of Accountancy noted in February 2026 that most tool vendors are not CPA firms and therefore cannot attest that controls are effective. We are in the same position. We prepare you for the audit; the CPA firm performs it.

What are the Trust Services Criteria?

Every SOC 2 report measures controls against the AICPA's 2017 Trust Services Criteria, with points of focus revised in 2022 (AICPA & CIMA). The criteria are grouped into five categories:

• Security, also called the common criteria, which is in scope for every SOC 2 report
• Availability
• Processing integrity
• Confidentiality
• Privacy

The four categories after Security are optional. Add them when they match commitments you make to customers. A hosting provider with uptime commitments usually includes Availability. A company that processes regulated personal data may add Privacy. Each added category adds criteria, controls and evidence, so scope only what customers will read.

When does a Type I make sense?

A Type I is a reasonable first step in a few situations:

• A customer deadline is close. A Type I can be issued once controls are designed and in place, without waiting out an observation period.
• This is your first report. It confirms your control design with an auditor before you commit to a period of testing.
• Your environment just changed. A new platform or a major reorganization may justify a fresh design assessment first.

A Type I is a stage, not a destination. Most enterprise security reviews ask for a Type II, because it is the only one that shows controls working over time. If you choose a Type I, plan the Type II observation period to start soon after, and tell customers when to expect it.

What do buyers look for in the report?

Experienced reviewers rarely stop at the opinion page. When your customer's security team, or the security questionnaire that follows, digs into your report, expect them to check:

1. Report type and period dates. A Type I, or a Type II whose period ended long ago, gets follow-up questions.
2. Scope. Which systems, services and Trust Services categories are covered, and whether the product they are buying is among them.
3. Exceptions. Any control test that failed, and management's response to it. Microsoft notes that management responses appear toward the end of its reports.
4. User entity responsibilities. Often called complementary user entity controls, these are the controls your customer must operate for your controls to achieve their purpose, such as managing their own user access.
5. Subservice organizations. Providers you rely on, such as your cloud host, and whether their controls are tested in your report or excluded and covered by their own reports.
6. The CPA firm. The Journal of Accountancy suggests evaluating the firm's qualifications, experience and peer review results, and whether the report is tailored to the system examined.

What is a bridge letter?

A SOC 2 report covers a fixed period, and customers often ask about the time since it ended. A bridge letter covers that gap. AWS publishes a continued operations letter, also known as a bridge letter, covering the time from the end of the last report period to the letter date. Microsoft issues quarterly bridge letters covering the prior three months.

A bridge letter is a statement about continued operations, not a new auditor's opinion. Keep the gap short by scheduling renewal periods back to back.

A practical readiness path

1. Confirm what customers are asking for. Report type, categories and acceptable period length.
2. Define scope. Systems, services, locations and subservice organizations.
3. Run a gap assessment against the Trust Services Criteria in scope.
4. Close the gaps. Write missing policies, implement controls and assign an owner to each one.
5. Build the evidence routine. Access reviews, change approvals and monitoring records generated as part of normal work.
6. Engage the CPA firm early to agree type, scope and period dates.
7. Complete the Type I, or start the Type II period, once controls run as described.
8. Keep it running so each renewal is routine rather than a scramble.

Our SOC 2 readiness and renewal support covers each of these steps, and our advisory services help you decide scope and sequencing. If you are weighing Type I against Type II for a specific deal, talk to us about the timeline.