SOC 2 Compliance Guide: Type 1 vs Type 2, Trust Services Criteria and Timeline

A big prospect loves your product. Then their procurement team sends a security questionnaire with one line in bold: “Please provide your most recent SOC 2 Type 2 report.” If you don’t have one, the deal stalls.

That’s how most companies meet SOC 2 compliance. It isn’t a law, but for B2B software and service companies it has become a common way for customers to judge whether you can be trusted with their data. This guide explains what SOC 2 is, the difference between Type 1 and Type 2, the Trust Services Criteria, and the steps and timeline to get your first report.

What SOC 2 is (and what it isn’t)

SOC stands for System and Organization Controls. The American Institute of Certified Public Accountants (AICPA) describes SOC as a suite of services CPAs provide to report on controls at service organizations, helping customers assess the risks of outsourcing to them.

A few points trip people up:

• It’s an attestation report, not a certification. A licensed CPA firm examines your controls and issues an opinion. There’s no SOC 2 “certificate” from the AICPA.
• You design the controls. The criteria describe outcomes. You decide which policies, processes and tools achieve them.
• Reports are usually shared under NDA. SOC 2 reports contain detail about your systems and go to customers and prospects who need them.
• SOC 2 is one of several SOC reports. SOC 1 covers controls relevant to customers’ financial reporting. SOC 3 uses the same criteria as SOC 2 but is a shorter report meant for general distribution.

SOC 2 Type 1 vs Type 2

The AICPA’s Journal of Accountancy summarizes the difference: a Type 1 looks at design “as of a specified date,” while a Type 2 also covers operating effectiveness “throughout a specified period” and includes a description of the auditor’s tests and results.

Many companies get a Type 1 first to satisfy early deals, then move to Type 2. Others skip straight to Type 2 if their controls are already mature. Agree the observation period with your auditor; it’s commonly several months long.

Key takeaway: A Type 1 proves you designed the right controls. A Type 2 proves they actually worked over time, which is why most enterprise buyers ask for it.

The 5 Trust Services Criteria

SOC 2 examinations use the AICPA’s 2017 Trust Services Criteria, which the AICPA reissued with revised points of focus in 2022. The categories and criteria themselves didn’t change in that update; the points of focus are guidance on how criteria might be met.

The Security category holds the “common criteria,” which cover areas like the control environment, risk assessment, monitoring, logical and physical access, system operations, change management and risk mitigation. Every SOC 2 report includes them.

Choose optional categories based on what you promise customers. If you sell uptime commitments, add availability. If you process transactions, consider processing integrity. If you handle personal data in ways customers care about, consider privacy. Adding categories increases scope and work, so don’t add them just because you can.

The AICPA also publishes mappings from the Trust Services Criteria to other frameworks such as NIST SP 800-53, which helps if you already follow another standard.

Who needs SOC 2

You likely need SOC 2 if you:

• Sell SaaS or cloud services to other businesses.
• Store, process or transmit customer data on their behalf.
• Provide managed IT, security, payroll, data analytics or similar outsourced services.
• Keep losing time on long security questionnaires.

If you’re a buyer, asking vendors for SOC 2 reports is a practical part of choosing partners; our guide to choosing a managed IT service provider shows how to use them.

Healthcare companies often need both SOC 2 and HIPAA compliance. They overlap, but one doesn’t replace the other.

Common controls auditors expect

Every company’s controls differ, but most first-time SOC 2 programs include these:

Strong identity controls carry a lot of weight. If you’re modernizing logins, see our guides to passkeys and zero trust security.

SOC 2 timeline and steps

Timelines depend on your starting maturity, the categories in scope and whether you choose Type 1 or Type 2. Here’s the typical path.

Step 1: define scope

Decide which products, systems, locations, teams and Trust Services Criteria categories are in scope. Narrower scope means a faster first report.

Step 2: run a readiness or gap assessment

Compare current practices to the criteria. Many CPA firms and consultants offer readiness assessments; some companies use compliance automation software to map controls and collect evidence.

Step 3: close the gaps

Write missing policies, turn on MFA and logging, formalize access reviews, document change management, and train staff. This is usually the longest phase for first-timers.

Step 4: choose your CPA firm

Only a licensed CPA firm can issue a SOC 2 report. Ask about experience with companies like yours, peer review status, timeline, and how they gather evidence. The AICPA has publicly said it was looking into allegations about a compliance vendor’s SOC practices and that SOC services should be thoroughly evaluated, so check your auditor’s credentials.

Step 5: Type 1 examination or start the Type 2 period

For a Type 1, the auditor tests design as of a date. For a Type 2, your controls must operate through the observation period while you keep evidence.

Step 6: fieldwork and report

The auditor tests controls, raises any exceptions and issues the report with management’s assertion and a description of your system.

Step 7: maintain and renew

SOC 2 isn’t one-and-done. Customers expect a current report, so most companies run a new Type 2 period each year.

How SOC 2 compares with other frameworks

Customers sometimes ask for other frameworks alongside or instead of SOC 2. Here’s how the common ones differ at a high level.

There’s a lot of overlap. Access control, logging, risk assessment, vendor management and incident response show up in all of them. If you plan to pursue more than one, map your controls once and reuse the evidence, which is where the AICPA’s published mappings help.

What SOC 2 costs

Costs vary by firm, scope, company size and readiness, so be wary of any flat number. Expect to pay for some mix of:

• Auditor fees for the Type 1 or Type 2 examination.
• Readiness help from consultants or the audit firm’s advisory arm.
• Compliance automation software, usually a subscription.
• Security tools you may need to add, such as endpoint protection, logging or MFA.
• Internal time, which is often the largest hidden cost.

Ask 2 or 3 CPA firms for proposals using the same scope to compare fairly.

Conclusion

SOC 2 compliance is a sales tool as much as a security program. Start with a tight scope and the Security category, close gaps with controls you’ll actually keep running, and choose a reputable CPA firm. A Type 1 can unblock early deals, but plan for Type 2, because that’s the report enterprise customers trust. New to the terms? Our glossary explains them.

Sources

• AICPA: System and Organization Controls (SOC) suite of services — what SOC reports are, CPA role, and the notice on evaluating SOC service providers
• AICPA: 2017 Trust Services Criteria (With Revised Points of Focus — 2022) — the 5 categories used in SOC 2 examinations
• Journal of Accountancy (AICPA): Explaining the 3 faces of SOC — Type 1 vs Type 2 and SOC 1, SOC 2, SOC 3 differences
• AICPA: Mapping of 2017 Trust Services Criteria to NIST 800-53 — framework mappings