The question comes up in nearly every enterprise sales cycle involving a SaaS company: "Are you SOC 2 certified?" The short answer from most compliance-savvy companies should be: "We have a SOC 2 Type II report" — but the longer answer involves understanding what SOC 2 actually measures, why Type I and Type II are fundamentally different things, and what it takes to get from "we should probably do this" to a report your enterprise customers will accept.
This guide is for the CFO, CIO, or operations lead at a mid-market company who has been told they need SOC 2 but hasn't been given a clear picture of what that actually means. It covers the Type I vs Type II distinction, what each report actually says, what it costs, and how to think about scoping your audit.
What SOC 2 Actually Is
SOC 2 (System and Organization Controls 2) is an audit framework developed by the AICPA (American Institute of Certified Public Accountants) that evaluates a service organization's controls relevant to security, availability, processing integrity, confidentiality, and privacy. These five categories are called the Trust Services Criteria.
Most SOC 2 audits focus on the Security criterion (also called the Common Criteria) as the required baseline, with other criteria added optionally based on the company's service and customer requirements. A company that processes payments might add Processing Integrity. A company handling sensitive client data under confidentiality agreements might add Confidentiality. A company with European customers handling personal data might add Privacy.
Critically, SOC 2 is not a certification — it is an audit report. There is no "SOC 2 certified" status in the same way there is ISO 27001 certification. A SOC 2 report is a document produced by a licensed CPA firm attesting to the state of your controls during a specified period. The report does not give you a pass/fail grade; it describes your controls, whether they were designed appropriately, and whether they operated effectively.
For the full context on what a SOC 2 audit involves, see our guide to what a SOC 2 audit actually is.
Type I: Design of Controls at a Point in Time
A SOC 2 Type I report evaluates whether your controls were suitably designed to meet the Trust Services Criteria as of a specific date. It is a point-in-time snapshot. The auditor reviews your documented policies, configurations, and control descriptions, and attests that as of the report date, those controls appear to be designed to address the relevant criteria.
What Type I does not do: it does not evaluate whether those controls actually worked over time. An auditor doing a Type I report is not reviewing six months of access logs. They're not pulling evidence that your patch management process ran on schedule. They're not testing whether your incident response procedure was followed when an anomaly was detected. They're reviewing the design, not the operation.
Type I is faster and cheaper to obtain. A Type I audit for a typical 30–150 person SaaS company generally costs $8,000–$25,000 in audit fees, plus readiness preparation costs. The timeline from engaging an auditor to receiving a report is typically 6–12 weeks if the company is reasonably prepared.
Type I is appropriate when: you have a near-term sales requirement to demonstrate some level of security oversight, you're early in your compliance program and want external validation before investing in the longer Type II process, or your customers have accepted Type I in the past and you're working toward Type II.
Type II: Operating Effectiveness Over a Period
A SOC 2 Type II report evaluates whether your controls were suitably designed and operated effectively over a defined observation period — typically six months to twelve months. The auditor is not just reviewing your control documentation; they're pulling evidence that each control actually ran as documented throughout the observation period.
That means reviewing access log samples, patch management records, vulnerability scan results, user access review documentation, incident response logs, change management tickets, and backup restoration test records — among many other evidence types, depending on your scope. The audit is significantly more evidence-intensive than Type I.
Type II costs more and takes longer. A Type II audit for a typical 30–150 person SaaS company typically costs $15,000–$60,000 in audit fees depending on scope and auditor. The observation period needs to accumulate before the audit can conclude, so the total timeline from decision to report is typically 9–18 months (3–6 months of readiness preparation + observation period + audit fieldwork and report issuance).
Type II is the standard that enterprise customers and sophisticated buyers actually want. When an enterprise security team asks "do you have SOC 2," they almost always mean Type II. A Type I report buys you time in some sales cycles, but it will not satisfy rigorous security review processes at financial services companies, healthcare organizations, or government-adjacent buyers.
What the Report Actually Contains
A SOC 2 report is a multi-section document. The key sections are:
The auditor's opinion letter. The most important section — states whether the auditor found your controls to be suitably designed (Type I) or suitably designed and operating effectively (Type II). Also notes any exceptions (controls that did not operate as described).
Management's description of the system. Your description of your service, infrastructure, and control environment. This section is written by management, not the auditor — it's your opportunity to describe your security posture in a structured way. Auditors do not verify the accuracy of every claim in this section, but they will flag material misrepresentations.
The description of controls and auditor's tests. A detailed list of controls, the tests the auditor performed, and the results. This is the section that sophisticated security reviewers actually read. Exceptions — controls where the auditor found the control did not operate as described — appear here. A report with multiple exceptions is a concern; a report with one or two minor exceptions with documented remediation is normal.
Common Scoping Mistakes
The two most expensive scoping mistakes in SOC 2 are:
Including too many systems. SOC 2 scope is defined by what's in your "system boundary" — the infrastructure, applications, and processes that deliver your service. Companies that include every internal tool, every SaaS application, and every business process in scope create enormous evidence-collection burdens and extend audit timelines significantly. Tightly defined scope reduces cost and complexity without sacrificing the security value of the report.
Including the wrong Trust Services Criteria. Unless your customers are explicitly asking for Availability, Processing Integrity, Confidentiality, or Privacy, start with Security (Common Criteria) only. Adding criteria without customer demand is cost with no sales benefit.
Preparing for a Type II Observation Period
The observation period is where many companies struggle. A Type II report reflects controls operating over a sustained period — which means controls that are designed but not consistently executed will produce exceptions.
The controls that most commonly produce exceptions in first-time Type II audits are: access reviews (planned but not run on schedule), vulnerability management (scans scheduled but remediation SLAs missed), change management (changes made outside the documented process), and security awareness training (not completed by all required personnel on schedule). Building operational rigor around these before the observation period begins substantially reduces the exception risk.
Frequently Asked Questions
Can you have a Type I and then a Type II?
Yes, and this is the most common path. Many companies obtain a Type I report first — to demonstrate security intent to near-term prospects while establishing their controls — and then begin the observation period for Type II. The Type I work is not wasted; the control documentation and readiness work carries forward into the Type II process.
How long is a SOC 2 report valid?
There is no official expiration date for a SOC 2 report, but the market treats reports older than 12 months as stale. Most companies with ongoing enterprise sales requirements renew their Type II audit annually. A 12-month observation period Type II report issued in September covers the previous September through September — companies typically start the next observation period before the current report is issued to avoid gaps.
Who can perform a SOC 2 audit?
Only licensed CPA firms can issue SOC 2 reports under AICPA standards. Compliance software vendors (Vanta, Drata, Secureframe, etc.) are readiness platforms that help you prepare evidence and manage controls — they are not auditors and cannot issue the report. You need both: a readiness platform to manage the operational work and a licensed CPA firm to conduct the actual audit.
What is the difference between SOC 2 and ISO 27001?
SOC 2 is an AICPA audit standard widely required by US enterprise buyers; ISO 27001 is an international standard (ISO/IEC) that is more widely used in Europe and Asia. SOC 2 produces an audit report; ISO 27001 results in a certification by an accredited certification body. The two have significant overlap in underlying controls but different evidence and documentation requirements. US-focused SaaS companies typically pursue SOC 2 first; companies with European customers or multinational operations often pursue both. See our ISO 27001 guide for SMBs for the comparison.
For what each report type actually costs and how long it realistically takes — beyond the definitional difference — see our companion guide, SOC 2 Type 1 vs Type 2: A Buyer's Guide to Real Cost and Timeline.
← Top IT Providers in Denver and Boulder | Multi-Cloud vs Hybrid Cloud →