The first time a customer asks for "your SOC 2", the follow-up question is usually "which one?" There are two types of SOC 2 report, they answer different questions, and starting with the wrong one can add months to a sales cycle. This guide explains the difference in plain English: what each report contains, how long each takes, and the path most SaaS companies follow.
The short answer
A SOC 2 Type 1 report says your security controls were suitably designed and in place on a single date. A SOC 2 Type 2 report says those controls were designed and also operated effectively over a period of time, usually between three and twelve months. Type 2 is the stronger report and the one most enterprise buyers ultimately want. Type 1 is faster, and is often used to unblock deals while the Type 2 observation period runs.
What SOC 2 is, briefly
SOC 2 is an attestation report issued by an independent CPA firm under standards set by the American Institute of Certified Public Accountants (AICPA). It reports on your controls against the Trust Services Criteria: Security, which is mandatory, plus Availability, Confidentiality, Processing Integrity and Privacy, which you add only if your customers need them. Type 1 and Type 2 use the same criteria. The difference is what the auditor tests.
SOC 2 Type 1: design at a point in time
For a Type 1, the auditor picks a date and examines whether your controls on that date are suitably designed to meet the criteria and have actually been implemented. They read your policies, inspect configurations, review your system description and typically test a single instance of each control.
A Type 1 tells a customer you have thought about security properly and the controls exist. It does not tell them whether anyone follows those controls on an ordinary Tuesday six months later.
- Timeline: once remediation is done, audit fieldwork usually takes a few weeks, and the report follows shortly after.
- Best for: a first report to unblock a waiting deal, or a company that has only just put its controls in place.
SOC 2 Type 2: operating effectiveness over time
For a Type 2, the auditor examines a period, called the observation period or review period, and tests whether each control operated effectively throughout it. Instead of one example, they sample: a selection of new starters to confirm onboarding checks happened, a selection of leavers to confirm access was removed promptly, several quarterly access reviews, and a sample of production changes to confirm each was reviewed and approved.
Observation periods commonly run from three to twelve months. A first Type 2 often covers three to six months; renewals usually cover twelve, so the reports run back to back and coverage is continuous.
- Timeline: the observation period, plus a few weeks of fieldwork and reporting after it ends.
- Best for: enterprise and US customers, regulated industries, and anyone whose procurement questionnaire has "SOC 2 Type II" written on it.
Type 1 vs Type 2 side by side
| SOC 2 Type 1 | SOC 2 Type 2 | |
|---|---|---|
| Question answered | Are the controls designed and in place? | Did the controls work, consistently, over time? |
| Period covered | A single date | Usually 3 to 12 months |
| Auditor testing | Design and implementation | Design, implementation and operating effectiveness, by sampling |
| Time to report after remediation | Weeks | Observation period plus weeks |
| Weight with enterprise buyers | Accepted as a first step | The report most buyers expect |
| Renewal | Usually replaced by a Type 2 | Annually |
Which should you get first?
Ask the customer who requested it. If the contract says Type 2 and nothing else will do, plan for the observation period now. In practice, many buyers will accept a Type 1 together with a committed date for the Type 2, which is why the most common path for a SaaS company is:
- Remediate to Type 2 standard from the start. The controls are the same for both reports; only the evidence period differs.
- Get a Type 1 as soon as the controls are in place, to unblock the deals that are waiting.
- Start the Type 2 observation period straight after the Type 1 date, so there is no gap.
- Renew annually with a twelve-month observation period, so coverage is continuous.
Going straight to Type 2 without a Type 1 is also common, especially when no deal is waiting. It saves one audit fee, at the cost of having nothing to show customers until the observation period ends.
What makes a Type 2 go wrong
Type 1 audits rarely surprise anyone, because the auditor is looking at controls you have just put in place. Type 2 exceptions come from the controls that depend on people doing something regularly:
- Access reviews scheduled quarterly and done twice.
- Offboarding where a leaver kept access to one SaaS tool for three weeks.
- Change management where an urgent fix went to production without a review.
- Restore tests that were planned but never recorded.
- Vendor reviews and training that slipped when the person who owned them left.
An exception is not a failed audit. It appears in the report alongside management's response, and customers read it. A handful of minor exceptions is normal; a pattern of them weakens the report. The fix is to make recurring controls automatic or clearly owned, and to monitor them, which is where compliance automation platforms such as Vanta earn their place. Our SOC 2 remediation guide covers how to get the controls green in the first place.
Notes for Australian companies
SOC 2 is a US standard, but Australian SaaS and technology companies get it for the same reason as everyone else: their customers ask for it. A few practical points:
- Auditors. The report must be issued by an independent CPA firm. Some Australian firms offer SOC 2 through CPA-licensed partners, and US firms routinely audit Australian companies remotely.
- Other frameworks. Local enterprise and government customers may ask for ISO 27001 or the Essential Eight instead of, or as well as, SOC 2. Most controls overlap, so map them once.
- Privacy criteria. If you include the Privacy criteria, align them with your obligations under the Privacy Act 1988 and the Australian Privacy Principles.
Where Orbit3 fits
We do the work between "we need SOC 2" and "here is the report": scoping, fixing the failing controls in Vanta, operating the recurring tasks through the observation period, and preparing the evidence your auditor will sample. See our SOC 2 compliance service, or get in touch and we will tell you which report to aim for first and how long it should realistically take.