SOC 1 Type 1 vs Type 2, explained
The most misunderstood distinction in SOC 1: Type 1 is about design at a point in time; Type 2 is about operating effectiveness over time. Here’s what changes -- cost, effort, timeline, and acceptance.
Type 1: the CPA firm opines that your controls were suitably designed as of a specific date -- 4–12 weeks, planning estimate $10K–$30K. Type 2: the firm opines that controls were suitably designed and operated effectively throughout a 6–12 month period -- 8–14 months end to end, planning estimate $20K–$100K+. Most enterprise customers require a Type 2.
| Type 1 | Type 2 | |
|---|---|---|
| Opinion covers | Design suitability at a point in time | Design suitability + operating effectiveness over a period |
| Observation period | None | 6–12 months (SSAE 18 minimum: 6) |
| Typical timeline | 4–12 weeks | 8–14 months (first-timer) |
| Planning-estimate fee | $10K–$30K | $20K–$100K+ |
| Evidence burden | Design documentation + walkthroughs | Design documentation + evidence across the full period + sampling |
| Customer acceptance | Interim / stepping stone | The standard enterprise requirement |
| Best for | First report, fast; proving design before the period | Annual program; satisfying customer auditors |
Fees are planning estimates (September 2026), not quotes.
When Type 1 is the right call
You need a report quickly for an active deal, your controls are newly documented, or you want to validate design before committing to a 6–12 month observation period. A Type 1 de-risks the Type 2: design flaws found now don’t become period exceptions later.
When you need Type 2
Your customers’ auditors must rely on your controls having operated -- not just been designed. That’s the Type 2’s job, and it’s what enterprise MSAs and RFPs overwhelmingly require. If you’re unsure, ask your largest customers what their auditors accept -- in writing.
The standard upgrade path
Readiness assessment → Type 1 → Type 2 observation period → annual Type 2 renewals. Each step’s work feeds the next; the Type 1’s validated design becomes the period’s testing baseline. See all three paths compared.
Type 1 vs Type 2 questions
Can a Type 1 satisfy an enterprise customer?
Sometimes -- as an interim step. Some customers accept a Type 1 for the first contract year while you complete the Type 2 observation period. Get the acceptance in writing with the timeline for delivering the Type 2.
Does a Type 1 count toward the Type 2 observation period?
No -- the Type 1 is point-in-time and doesn’t start any clock. But the control design work validated in the Type 1 is exactly what the Type 2 period then tests, so nothing is wasted.
What does the observation period require of us day-to-day?
Controls must operate consistently and evidence must be collected continuously -- access reviews on schedule, change tickets complete, reconciliations performed and retained. Gaps in the period become report exceptions.
→ Take the 2-minute path quiz · Cost by path
Know which report you need?
Get scoped quotes from licensed CPA firms -- Type 1 or Type 2, matched to your timeline.
How it works: tell us once (4 questions, 2 min) → we match licensed auditors to your size and scope → they send scoped quotes directly. Free, no obligation.