Glossary · Frameworks & standards
What is SOC 2 Type I?
Also known as: SOC 2 Type 1, SOC 2 Type I report, Type I attestation
SOC 2 Type I is a SOC 2 report that evaluates whether a service organization's controls are suitably designed to meet the relevant Trust Services Criteria at a single point in time. It is faster to obtain than a Type II and is often used as a first, credible security proof while the observation period for a Type II accrues.
Key takeaways
- Type I tests control design 'as of' a specific date, not operation over time.
- Faster than Type II because it needs no multi-month observation window.
- A useful first proof to unblock early sales and security reviews.
- The same controls carry straight into a subsequent Type II window.
- Enterprise buyers usually want a Type II eventually, so Type I is typically a stepping stone.
Type I vs Type II
A Type I opines on whether controls are designed correctly at a point in time. A SOC 2 Type II goes further and tests whether those controls actually operated effectively over a period - usually three to twelve months. Type II gives buyers more confidence, but Type I is faster to produce.
Most companies get a Type I first to move deals forward, then complete a Type II observation window. If controls have already been running for several months, an organization can go straight to Type II.
Frequently asked questions
- Is a SOC 2 Type I worth it if I'll need Type II?
- Yes. Type I is a fast, credible interim proof that unblocks sales while your Type II observation window runs, and the same controls carry directly into the Type II.
- How long does a SOC 2 Type I take?
- Once controls are in place, a Type I can often be completed in a few weeks, because it assesses design at a point in time rather than operation over a period.