What is the difference between a SOC 2 Type 1 and a Type 2 report?

A Type 1 report looks at whether controls are suitably designed and in place at one point in time; a Type 2 report also tests whether they operated effectively over a period, typically several months. Type 1 answers “do you have the right controls on this date?”; Type 2 answers “did they actually work throughout?”, which is why customers who rely on a supplier usually prefer it. A Type 2 needs evidence collected across the whole period: access reviews done on schedule, changes approved before release, incidents handled as the procedure says, monitoring alerts reviewed. A company often starts with Type 1 to fix its design, then runs the controls and collects evidence for a Type 2. When you read either, check the dates, the scope, the criteria covered and every exception the auditor lists, and ask how the exceptions were fixed. NetSenX’s own status is stated plainly: SOCSOC: security operations centre. A team, often working around the clock, whose job is to watch for and respond to attacks. 2 Type I is in preparation, no SOC 2 report of either type has been issued, and Type II would follow once controls have run over a period.

← All 15 questions on Security standards: ISO 27001, SOC 2All topics