Procurement and Tooling
SOC 2 Type 1 and Type 2
A Type 1 report covers whether controls are suitably designed at a point in time. A Type 2 report covers whether they operated effectively across a period, commonly three to twelve months.
Why it matters: buyers who specify SOC 2 almost always mean Type 2, and the observation period is why it cannot be produced quickly.
Related terms
Questions about how this applies to you? Book a free 45 minute diagnostic.