A customer asked for your SOC 2 report, and the first question every guide throws at you is Type 1 or Type 2. Most of them make it sound like a big strategic choice. For most startups it isn't.
The checklist is the same for both. A Type 1 looks at your controls on one day. A Type 2 looks at the same controls over a period of at least three months. Your customer's security team wants the Type 2, so that's the one to start.
Key takeaways
- Same work, different window. Type 2 adds an observation period, not a different checklist.
- Go straight to Type 2. Doing both means paying for a second report, and buyers still ask when the Type 2 is coming.
- Type 1 has one good use. A signed deal that needs a report in the next six weeks.
- You are not empty-handed while you wait. An auditor's engagement letter with dates, and an honest "SOC 2 in progress" line, carry most deals to the report.
What actually differs between Type 1 and Type 2?
SOC 2 is not a certification. It's an attestation report, written and signed by a licensed CPA firm after it examines your controls (here is what SOC 2 actually is). Type 1 and Type 2 are two flavours of that report.
A Type 1 answers one question: on this date, were your controls designed correctly? The auditor reads your policies, checks your settings and takes a snapshot.
A Type 2 answers a harder one: over this period, did your controls actually work? The auditor picks samples across the window. Was that new hire's access approved? Was the leaver offboarded the same day? Did someone review access last quarter? A policy that exists only on paper shows up here.
| Type 1 | Type 2 | |
|---|---|---|
| What the auditor checks | Your controls are designed correctly, on one date | Your controls are designed correctly and worked, every day of a period |
| Period covered | A single day | At least 3 months for a first report, up to 12 |
| Checklist you prepare | The same | The same |
| Evidence | A snapshot: policies, settings, screenshots | Samples across the period: access reviews, onboarding, offboarding, incidents, changes |
| Report in hand | A few weeks after your controls are in place | About 3 to 4 months after you start |
| Audit fee | Depends on the firm: about $5,000 to $40,000 | Depends on the firm: about $5,000 to $40,000. Doing both with the same firm usually comes as a bundle |
| What buyers do with it | Accept it as a stopgap, ask when the Type 2 lands | Accept it. This is the report security teams expect |
Both reports use the same Trust Services Criteria. Security is the only one that is required, and it's the only one most startups need. Add availability, confidentiality, processing integrity or privacy only when a customer asks for it in writing.
Which one do you need?
Default: go straight to Type 2. The work to get ready is identical, and the Type 2 is what your buyer's security team will ask for in the end. A Type 1 first means paying for a second report, answering the auditor twice, and still getting the "when is your Type 2?" email.
We have run hundreds of audits. Only three of our customers ever needed a Type 1. Each time, the reason was the same.
When a Type 1 is the right call
- A deal closes in the next six weeks and the buyer wrote that they need a report, not a letter. A Type 1 gets you a signed report fast, and the Type 2 observation period starts the same day.
- Your infrastructure is about to change, for example a cloud migration next quarter. A Type 1 now covers the gap, and the Type 2 window starts once the new setup is stable, so you don't audit a system you are about to throw away.
When you might not need either yet
If no customer has asked in writing, wait. SOC 2 is a business decision, not a rite of passage. Here is how to decide if you need a SOC 2 report, and whether SOC 2 or ISO 27001 fits your buyers better.
What do you show your customer while the Type 2 runs?
This is the real reason founders reach for a Type 1: a customer wants proof now, and three months feels long. In practice, enterprise buyers rarely need the report on day one. They need confidence that it's coming, with a date.
Three things give them that:
- An engagement letter from the auditor, naming the CPA firm, the report type and the observation dates. It's a document a security team can file.
- A dated "SOC 2 in progress" line on your security page: "Type 2 examination with [firm], observation period 1 December to 28 February, report expected in March." Here is how to announce SOC 2 in progress without overclaiming, with an email template.
- Your security questionnaire, answered, and your policies available under NDA. Most buyers send a questionnaire with or without a report anyway.
One rule: only say "in progress" when it's true. Signing up for a compliance tool is not a status. An auditor booked with dates is.
What does the timeline look like with real dates?
"About three months" is hard to plan around. Here is what a Type 2 looks like for a startup that starts in November:
| When | What happens |
|---|---|
| Week 1 | Auditor booked, engagement letter signed, "in progress" line goes on the security page |
| November | Risk analysis, policies written for your company, vendor reviews, controls switched on |
| 1 December to 28 February | Observation period: controls run, evidence is collected as it happens |
| March | Auditor fieldwork, then the signed report |
Ask any auditor for their lead time before you commit to a date. Booking the audit early is what keeps the project moving. More on how long SOC 2 takes.
If a customer's contract depends on the report, write the date into that contract: certified within four months. Sign with your compliance provider the day the customer signs with you, and the money goes out after the revenue it unlocks.
What does each one cost?
The audit fee depends mostly on who signs the report. A Type 2 ranges from about $5,000 with a smaller US peer-reviewed CPA firm to $40,000 with the large audit brands. A Type 1 on its own sits in the same range. If you do both with the same firm, most offer a bundle well below the price of two separate audits. Your headcount, your infrastructure and the Trust Services Criteria you include move the price within that range.
For a company under 15 people, the peer-reviewed firm most of our customers use charges about $5,000 for a Type 2, and about $6,500 for a Type 1 plus a Type 2. Whichever firm you pick, ask for the Type 2 alone and the bundle side by side. Pay for a big brand only when a customer insists on a name.
The audit is one of three costs. The platform and the people doing the work are the other two, and the people are the biggest line, whether you pay a provider or spend 40 to 100 hours of your own time. All in, a startup under 15 people working with a smaller peer-reviewed firm pays about $15,000 for year one. Full breakdown by company size: SOC 2 cost in 2026.
Be wary of $1,000 or $2,000 audits. A SOC 2 report is worth the auditor who signs it, and your customer's security team will read the report. Ask who signs it, ask for the firm's AICPA peer review letter, and check it on the AICPA site.
What happens after the first report?
A Type 2 covers a period, so it ages. Buyers usually want a report that ended within the last twelve months. The next observation period starts the day after the previous one ends, and the next report covers the full year.
Between two reports, if a customer asks whether anything changed, you send a bridge letter: a short letter signed by your management saying no significant change happened since the last report ended. The controls keep running all year. That's the part tools leave to you, and the part that slips first.
How Probo helps you get the Type 2
Probo is an open-source compliance platform plus a compliance officer who does the work. We do the compliance, you do the tech. Here is what that looks like for a SOC 2 Type 2:
- The right report, on day one. We tell you whether you need a Type 1 at all (usually not), which Trust Services Criteria to include, and whether SOC 2 or ISO 27001 fits your buyers.
- Proof the day after you sign. An engagement letter from Probo, then one from the auditor with the audit dates, so you can answer your customer within the week.
- An auditor you can verify. We book a peer-reviewed CPA firm within a week, or work with the auditor you already chose after a reference check. You pay the auditor at cost. We take no margin on the audit.
- The work done for you. Your compliance officer runs the risk analysis, writes the policies for your company (not templates), reviews your vendors, collects evidence with you during the observation period and handles the auditor's requests. You spend 5 to 10 hours of engineering time over the whole project.
- A trust page that says where you stand. Your compliance portal shows "SOC 2 Type 2 in progress" while the audit runs, then shares the report and your policies with buyers once it's signed.
- The year after. The next observation period starts right away. We run the access reviews, vendor reviews and policy updates through the year so the next report is not a scramble.
- No lock-in. The platform is open source. Your data is exportable at any time, and you can self-host if you leave.
If a deal really does need a Type 1 in the next few weeks, we set it up the same way and start the Type 2 window the same day.
The bottom line
Type 1 and Type 2 are the same work. The Type 2 is the report your customer will ask for, so start there, book the auditor early, and show the engagement letter while the observation period runs. Keep the Type 1 for the deal that cannot wait six weeks.
If a customer just asked for your report, book a 15-minute call. Send us their email, and we'll tell you which report you need, the dates, and the full price, audit included, on the call.
Frequently asked questions
What is the difference between SOC 2 Type 1 and Type 2?
Both reports cover the same controls. A Type 1 says your controls were designed correctly on a single date. A Type 2 says they were designed correctly and actually worked over a period, at least three months for a first report. The checklist you prepare is the same; Type 2 adds the observation period.
Should I get a SOC 2 Type 1 before the Type 2?
Usually not. Most audit firms offer a bundle if you do both with them (about $1,500 more with the firm most of our customers use), but it is still a second report and a second round of auditor requests, and most buyers ask when the Type 2 is coming anyway. Only three of our customers ever needed a Type 1, each because a deal was closing within about six weeks. Everyone else went straight to Type 2 and showed the auditor's engagement letter while the observation period ran.
How much does a SOC 2 Type 1 cost compared to a Type 2?
It depends mostly on the audit firm. A Type 2 audit ranges from about $5,000 with a smaller peer-reviewed CPA firm to $40,000 with the large audit brands, and a Type 1 on its own sits in the same range. Most firms offer a bundle if you do both with them. Headcount and infrastructure move it too. The audit is only one of three costs: with the platform and the people doing the work, a startup under 15 people using a smaller peer-reviewed firm pays about $15,000 for year one.
How long is the SOC 2 Type 2 observation period?
Between three and twelve months. For a first report, three months is the norm and what most buyers accept. After that, each yearly report usually covers the twelve months since the last one, so there is no gap in coverage.
Do enterprise customers accept a SOC 2 Type 1?
Some accept it as a temporary answer, almost always with a follow-up question: when is the Type 2? Large enterprises and regulated buyers generally want the Type 2. If a buyer needs something today, an auditor's engagement letter with the audit dates, plus a completed security questionnaire, often does the same job as a Type 1.
Share on LinkedIn
