Which SOC 2 report should come first? Six client cases, practical decision tables and an illustrative 18-month cost comparison explain when to start with Type 1 and when to go straight to Type 2.
Short answer: get a Type 1 first, unless a buyer has explicitly required a Type 2 by a fixed date, or your controls are already operating and evidenced, for example under ISO 27001. Every enterprise buyer will want a Type 2 eventually. But a Type 1 gets a report into their hands months sooner, usually at lower cost, and the Type 2 follows on schedule.
A Type 1 first is the better path when:
The buyer hasn't set a clear requirement or deadline. A Type 1 gives you independent proof now, while the Type 2 isn't yet needed.
You need something in hand soon. The earliest a first Type 2 can usually be issued is four to five months away. A Type 1 can be issued in weeks once your controls are designed.
A compliance check stands between you and the first engagement. A Type 1 often gets you into a proof of concept or pilot while the Type 2 runs.
You're signalling maturity before you have buyers. A Type 1 lets you say you hold an independent SOC 2 report from day one.
It's your first SOC 2 and exceptions would hurt. A Type 1 works as a trial run, so gaps are found and fixed before your Type 2 is tested.
Going straight to a Type 2 makes sense in two situations: a buyer requires a Type 2 by a fixed date and won't accept a Type 1 in the meantime, or your controls already operate and can be evidenced, for example under ISO 27001. Cases 5 and 6 below show one of each.
| SOC 2 Type 1 | SOC 2 Type 2 | |
|---|---|---|
| What it shows | Controls are suitably designed and in place on a specific date | Controls operated effectively over a period |
| Observation period | None | At least about 3 months in practice; buyers prefer 6 to 12 |
| Time to a first report | A few weeks once controls are designed | About 4 to 5 months at the earliest |
| Relative cost | Lower; included free with a Type 2 at Throughline | Higher |
| Best for | Getting a report to buyers now; a trial run before a first Type 2 | Firm buyer requirements; annual, recurring assurance |
Yes. Almost every enterprise buyer expects an annual, recurring Type 2 in the long run. A Type 2 shows your controls operated over a period of time, not just that they were designed. That's the assurance a large customer needs before it relies on you year after year.
We don't dispute that. The question this article answers is different: what's the best path to that Type 2? For most companies, the answer is a Type 1 first. The Type 2 is the destination; the Type 1 is how you start selling while you get there.
For what that assurance is intended to achieve, see what SOC 2 is really for.
A Type 1 tests that your controls are designed and in place on one date. A Type 2 tests that they operated every time they were meant to, across an observation period. The difference shows most in controls triggered by events.
Take onboarding. For a Type 1, you need a defined onboarding process that's in place. For a Type 2, every person who joined during the period must have gone through it, and the auditor samples from those actual joiners.
| Control type | Example | What a Type 1 tests | What a Type 2 tests |
|---|---|---|---|
| Event- based | Onboarding, offboarding, code changes, incidents | The process is designed and in place | A sample of actual events from the period, each checked against the process |
| Periodic | Quarterly access reviews | The review process is designed and in place | Each review due in the period was performed |
| Annual | Risk assessment, penetration test | Performed once, or committed to (see the Q&A below) | Performed once |
The reasoning is sound on its face: if a buyer will want a Type 2 anyway, why not go straight there? When a buyer has set a firm Type 2 requirement and a date with enough time to meet it, that's good advice, and we give it too.
Skipping the Type 1 doesn't make the work faster, though. Both reports need the same controls designed, implemented and documented. A Type 2 adds an operating period on top, so going straight to it only delays your first report.
But most companies seeking their first SOC 2 aren't in that position. The requirement is unclear, the timing is tight, or there's no buyer yet. In those situations, the order of the reports matters. Below are six client cases: four where a Type 1 first served the client better, and two where going straight to a Type 2 did.
Both paths reach the Type 2 at the same time. The difference is that a Type 1 first gives you an independent report to show buyers months earlier.
The Type 2 observation period can start as soon as your controls are ready, whether or not you get a Type 1. The Type 1 is issued at that same starting point, so it adds a report without adding time.
| Path | Readiness complete | Observation period, 3+ months | Audit complete |
|---|---|---|---|
| Type 1 first | Type 1 report | Report in hand: start trials, answer questionnaires, keep selling | Type 2 report |
| Type 2 only | Controls ready | No report to show buyers until the Type 2 is issued | Type 2 report |
These are six past client scenarios that Paul Wenham has worked through as a SOC 2 practitioner. Client names are withheld for confidentiality. In four, a Type 1 first got the company further, sooner or with less risk. In two, going straight to a Type 2 was the better call. The difference came down to the buyer's requirement, the deadline and how mature the company's controls already were.
| Case | Company | What the buyer required | Deadline | Better path | Why |
|---|---|---|---|---|---|
| 1 | Project management software | A SOC 2 report before a proof of concept could start; an annual Type 2 if a contract followed | None set for the Type 2; expected within 12 months of a contract | Type 1 first | Opened the proof of concept and deferred the Type 2 cost until the deal was proven |
| 2 | Supplier to an enterprise buyer | Confirmed compliance during the sales process; a Type 2 within 18 months | 18 months | Type 1 first | Replaced verbal assurances with an independent report; one Type 1 plus one Type 2 instead of two Type 2s |
| 3 | Pre-revenue fintech | No buyer yet; large banks expect evidence of maturity before engaging | None | Type 1 first | An independent SOC 2 report and the AICPA SOC logo before its first bank conversation |
| 4 | Blockchain company | Risk-aware customers, including the global enterprises it was pursuing, who would scrutinise the Type 2 | None set | Type 1 first | A trial run of the audit, so gaps were fixed before the first Type 2 period was tested |
| 5 | Australian call recording software company, ISO 27001 certified | Enterprise customers, first satisfied by ISO 27001, then wanting SOC 2 Type 2 as well | None set | Type 2 first | Controls were already operating, so a 12-month period that had largely already run gave a full Type 2 without waiting |
| 6 | Supplier to a mid- market technology company | A Type 2 specifically; a Type 1 wouldn't count | Fixed; only enough time for a 3-month period | Type 2 first | The only report the buyer would accept, timed to arrive by the deadline |
Yes. A Type 1 got a project management software company into a proof of concept with a global consulting firm, months before any Type 2 could have been issued.
The situation. The company's product needs a real trial to prove its value: a team has to run an actual project on it. The consulting firm required a SOC 2 report before that proof of concept could even begin, as its baseline for any engagement. If the proof of concept succeeded, the contract was expected to require an annual Type 2, due within roughly 12 months of signing.
Why a Type 1 first. Compliance was blocking the trial, not the contract. Waiting for a Type 2 would have meant at least four to five months before the proof of concept could start: readiness work, a minimum observation period of about three months, then the audit itself. A Type 1 could be issued in weeks.
What it achieved.
It opened the proof of concept, so the company could start proving its value straight away.
It lowered the up-front investment. A Type 1 costs less than a Type 2, so the company didn't commit to the full cost before knowing the deal would close.
It bought time for the Type 2. The Type 2 became a contractual requirement after signing, with up to 12 months to deliver it.
The lesson: when a buyer asks for SOC 2 before a trial, check whether a Type 1 meets that first gate. It often does, because the buyer's real concern is your baseline, not a full operating history.
Our guide to enterprise security reviews explains how buyers use the report alongside their wider due diligence.
Yes, as the first step. A Type 1 gave this company independent proof of compliance during the sales process, and still left 12 months to deliver the Type 2.
The situation. An enterprise buyer required SOC 2 compliance within 18 months. In the meantime it ran a rigorous review: security questionnaires, follow-up questions, and a request to confirm the company was compliant.
Why a Type 1 first. Saying "we're compliant" in a questionnaire is a claim. A Type 1 report is independent evidence that your controls are designed and in place. It answered the buyer's request with something an auditor had tested, not a verbal assurance.
The 18-month window made the sequence straightforward. A Type 1 early in the window still left about 12 months for a full Type 2 observation period and audit before the deadline.
What it achieved.
Credible assurance during the sales process, instead of self-declared compliance.
No risk to the deadline. The plan left about 12 months for the Type 2, well inside the 18.
Lower cost over the window. Going straight to a Type 2 to satisfy the early request would have put two Type 2 reports inside 18 months: one up front and an annual renewal. One Type 1 and one Type 2 cost less.
The lesson: a long deadline isn't a reason to wait. It's room to start with a Type 1, answer the buyer's questions with evidence, and land the Type 2 on time.
Often, yes. A pre-revenue fintech used a Type 1 to start conversations with banks before it had a single buyer.
The situation. The company had no customer yet and no buyer setting a requirement. Its target customers were large banks, which are among the most risk-averse buyers there are. Before a bank will spend time on a new supplier, it wants a sign that the company is mature enough to be worth the effort.
Why a Type 1 first. With no buyer mandate and no deadline, a Type 2 would have meant months of observation and a larger bill, with no specific deal to justify it. A Type 1 gave the company an independent SOC 2 report quickly and at lower cost.
It also let the company display the AICPA SOC logo on its website. The AICPA's logo guidelines make the logo available to organisations that have received a SOC report from a licensed CPA firm. The logo doesn't show which type of report you hold, so as an early signal of maturity, a Type 1 does the same job on the website.
What it achieved.
A credible signal before the first conversation. Banks could see an independently audited company, not a startup promising to get there.
Spending matched to the stage. The larger cost of a Type 2 waits until a real buyer needs it.
A head start on the Type 2. The controls are designed and tested, so the Type 2 observation period can begin whenever a buyer's timeline calls for it.
The lesson: if SOC 2 is what gets you into the room, a Type 1 gets you there sooner. Save the Type 2 for when a buyer is waiting for it.
Yes. A blockchain company used a Type 1 as a trial run, so it knew exactly what its first Type 2 would test before the observation period was assessed.
The situation. It was the company's first SOC 2, and nobody on the team had been through one. Its customers, including the global enterprises it was pursuing, were very risk-aware and would read the Type 2 closely, so the company wanted to avoid exceptions. The team had read the guidance but wasn't sure everything it needed was in place.
Why a Type 1 first. In a Type 2, a control that didn't operate as described is reported as an exception, and it stays in that report for every customer to read. A Type 1 audit walks through every control and the evidence the auditor will request, at a point when gaps can still be fixed.
What it achieved.
Certainty about what was needed. The team saw exactly which controls were tested and what evidence each one required.
Gaps closed early. Anything missing was fixed before it could become a Type 2 exception.
A confident start to the Type 2. The observation period began with controls the team had already been through with an auditor.
The lesson: if your customers will scrutinise your first Type 2, a Type 1 is the most practical way to rehearse it.
Often, yes. An Australian call recording software company, already ISO 27001 certified, went straight to a Type 2 covering 12 months, most of which had already run when the audit was planned.
The situation. The company sold call recording software to many enterprise customers. Its ISO 27001 certification satisfied them at first, but SOC 2 Type 2 was then requested as well. Most of what SOC 2 tests was already in place through its ISO 27001 work, and its controls had been operating for months with evidence to show it.
Why a Type 2 first. A Type 2 observation period can start in the past, as long as the controls were operating and there's evidence for the whole period. Because the company was already working in a compliant way, there was no remediation to wait for, and a trial run would have added little. It set a 12-month period that had largely already run, ending three to six months ahead.
What it achieved.
A 12-month Type 2, the coverage enterprise buyers prefer, without waiting a year from the start.
A report with substance: a full year of operating evidence, not a short window.
No remediation period, because the ISO 27001 work had already put the controls in place.
The lesson: if your controls already operate and you can evidence them, start the Type 2 period in the past and skip the Type 1.
Yes, when the buyer won't accept anything else and the deadline is fixed. This client timed a three-month Type 2 to reach its buyer, a mid-market technology company, by the deadline.
The situation. The buyer, a mid-market technology company, made a SOC 2 Type 2 its key requirement. A Type 1 wouldn't satisfy it, and the deadline left only enough time for a three-month observation period plus the audit.
Why a Type 2 first. A Type 1 would have cost time and money without meeting the requirement. The only report that counted was a Type 2, so the client started the shortest practical observation period straight away.
What it achieved.
The required report, on time. The Type 2 reached the buyer by its deadline.
No spend on a report the buyer wouldn't accept.
A Type 2 cycle under way, with the next annual report covering a longer period.
The lesson: a three-month Type 2 is usually weaker than starting with a Type 1. But when a buyer requires a Type 2, won't accept anything else and won't move its deadline, it's the right call.
Go straight to a Type 2 in two situations: a buyer has made a Type 2 a firm condition with a fixed date, or your controls are already operating and evidenced, for example under ISO 27001. For the first situation, all three of these need to be true:
A firm Type 2 requirement. The contract or the buyer's security team has said in writing that only a Type 2 will do, and a Type 1 won't move anything forward in the meantime.
A defined date. You know when the report is due, not just that one will be wanted "at some point".
Enough runway. The date leaves time for at least a three-month observation period plus the audit, and more if your controls still need work.
If there's only just enough time, run a three-month Type 2, as in Case 6. If the date is closer than that, no Type 2 can arrive in time. Ask the buyer whether a Type 1 now, with a committed Type 2 date, will let you proceed. In our experience, most buyers find some room once they see an independent report and a dated plan.
The second situation is an existing program such as ISO 27001. If your controls already operate and can be evidenced, a Type 2 period can start in the past, and a trial run adds little, as in Case 5. See SOC 2 vs ISO 27001: which one is best for you.
| Your situation | Our recommendation |
|---|---|
| No buyer requirement yet | Type 1 first |
| A buyer wants SOC 2 but hasn't said which type or when | Type 1 first |
| SOC 2 is a condition of a trial or proof of concept | Type 1 first, then Type 2 once the contract is signed |
| A buyer requires a Type 2 within 12 to 18 months and wants assurance before then | Type 1 first, Type 2 within the window |
| It's your first SOC 2, customers will scrutinise the Type 2, and you're unsure everything is in place | Type 1 first, as a trial run |
| You hold ISO 27001, or your controls have otherwise operated with evidence for months | Type 2 first, with a period that starts in the past |
| A buyer requires a Type 2 by a fixed date, won't accept a Type 1, and the date allows a 3-month period plus the audit | Type 2 first, with a 3-month period |
| A buyer requires a Type 2 by a date too soon for any Type 2 | Type 1 now, and negotiate the Type 2 date |
| A buyer requires a Type 2 by a defined date 5 or more months away, and a Type 1 won't help in the meantime | Type 2 first |
Usually not. Over the first 18 months, a Type 1 then a Type 2 typically costs less than going straight to a Type 2, because it delays the start of your annual Type 2 cycle.
Some firms, including Throughline, include the Type 1 free with a Type 2. Where firms do charge, a Type 1 and Type 2 package typically costs about $2,000 to $3,000 more than a Type 2 alone. That looks like an extra cost, but over 18 months it usually isn't.
A Type 2 is an annual, recurring report. As with any subscription, the earlier the cycle starts, the more you pay over a given window. Starting with a short Type 2 puts two Type 2 reports inside the first 18 months. Starting with a Type 1 puts one.
Illustrative fees in US dollars: a Type 2 at $10,000, and a Type 1 and Type 2 package at $12,000 to $13,000.
The Type 1 path also ends with a Type 2 covering a longer observation period, which enterprise buyers generally prefer to a three-month one.
| Type 2 first | Type 1 first | |
|---|---|---|
| First 6 months | A 3-month Type 2 | A Type 1 |
| By month 18 | A second Type 2, the annual renewal | A Type 2 covering a longer period |
| Reports in 18 months | Two Type 2s | One Type 1, one Type 2 |
| Total cost | $20,000 | $12,000 to $13,000 |
| Difference | Not applicable | About $7,000 to $8,000 less |
If a buyer requires a Type 2 early, within the first six months or so, you'll need that Type 2 regardless, and the Type 1 path saves less or nothing. That's the "Type 2 first" situation described above. In most other cases, a Type 1 first delays the cost of your recurring Type 2 without delaying your first report.
For a full breakdown of what SOC 2 costs, see How much does SOC 2 cost? The true all-in cost, category by category.
Usually four to five months at the earliest, once your controls are ready. A first Type 2 needs an observation period, and in practice auditors require at least three months. The audit and report then take several more weeks. Add readiness work beforehand if your controls aren't yet in place.
A few weeks once your controls are designed and in place. A Type 1 tests your controls at a single point in time, so there's no observation period to wait through. Most of the time goes into readiness, not the audit itself; see SOC 2 readiness assessments: your questions answered.
Often, as a first step. Many buyers accept a Type 1 for a trial, a pilot or the early stages of a contract, especially alongside a committed date for the Type 2. Some contracts require a Type 2 outright. If you're not sure which applies, ask.
Ask their security or procurement team directly, and offer a plan rather than a question. For example: "We can provide a SOC 2 Type 1 report in [month], and our Type 2 observation period starts the same month, with the report due by [month]. Will that let us proceed?" A dated plan with an independent report behind it is much easier to approve than an open-ended promise.
Say that you hold a SOC 2 Type 1 report, and give its date. SOC 2 isn't a certification, so precise wording is better than "certified" or a general "compliant". Buyers will ask for the report itself, and being precise up front builds trust.
Usually not. Over 18 months, a Type 1 then a Type 2 typically costs less than two Type 2 reports, because it delays the start of your annual Type 2 cycle (see the 18-month comparison above). Throughline also includes the Type 1 free with every Type 2 engagement.
No. The Type 2 observation period can run alongside the Type 1, so the Type 1 adds no time to the path. It can also surface gaps early, while there's still time to fix them before the Type 2 period is tested.
Usually not. A three-month Type 2 covers a short window at Type 2 cost, and many periodic and annual controls won't have operated within it. Enterprise buyers generally prefer a Type 2 covering 6 to 12 months, so a three-month report often carries little more weight than a Type 1. The exception is when a buyer requires a Type 2 and its deadline only allows three months, as in Case 6. For timing your period, see SOC 2 observation periods and deadlines.
Yes. Larger items such as a disaster recovery test or a penetration test can be designed and committed to, backed by evidence such as prior vulnerability scanning, so the Type 1 can be issued before they're performed. That lets you defer those costs until a buyer needs a Type 2.
Because a Type 1 first is good practice, and we don't want cost to be the reason a client skips it. Throughline includes a Type 1 at no extra cost with every Type 2 engagement.
A first Type 2 is the report most likely to contain exceptions. Exceptions usually come from gaps nobody knew about until the auditor tested the period, when it's too late to fix them. A Type 1 surfaces those gaps first, while there's still time to close them. It also shows your team exactly what evidence the auditor will ask for.
Including the Type 1 also means our advice to start with one never adds a fee. When a buyer's requirement and timeline point to a Type 2 first, we'll recommend that instead.
SOC 2 vs ISO 27001: which one is best for you
How much does SOC 2 cost? The true all-in cost, category by category
SOC 2 readiness assessments: your questions answered
SOC 2 observation periods and deadlines
Former PwC manager, founder of AssuranceLab and former Sensiba partner and Chief Innovation Officer. Now co-founder of Throughline, focused on compliance and assurance for AI-native companies.
SOC 2 for AI-native companies: simpler stacks, agents running the program in your own tools, concise policies, and a report that covers AI in production.
ISO 42001 isn't yet an enterprise requirement. What it covers, how it compares with SOC 2 and AIUC-1, and when it's worth it for an AI company.
How to cover production AI agents in SOC 2: governance, access, change management and monitoring, with indicative criteria mappings, customer responsibilities and practical audit expectations.
Australian companies need a SOC 2 report issued under the AICPA standards by a US-licensed CPA firm, delivered by a strong local team in Australian time zones. Here's how the provider options compare, and what to check.
Experienced CTOs don't choose a SOC 2 audit firm on price or speed. They look for tech stack expertise, a tailored approach, flexible scheduling, responsiveness and year-round partnership, because those factors decide how much time the audit really costs.
What Security, Availability, Confidentiality, Processing Integrity and Privacy each cover, how often they're included, and how to decide which belong in your SOC 2 report.
How long a SOC 2 Type 2 observation period should be, how to work backwards from a customer deadline, when auditors test, why reports run late and how much buffer to build in.
A category-by-category SOC 2 budget in USD, covering audit fees, readiness, platforms, penetration testing, consultants, internal assessments and operational costs. Learn what is required, what is optional, and what a quote can leave out.
Five signals of real quality in assurance and security, with practical guidance on building a compliance program that supports customer TPRM, repeatable enterprise reviews and revenue growth.
The person leading your SOC 2 audit is the most underrated factor in choosing an audit firm. Companies compare price, timelines and platform integrations, then barely ask who will actually do the work.
SOC 2 is a risk report, not a certificate. Understand how enterprise customers use it, why having a report is only base camp, and how to turn your audit into a trust asset for growing revenue.
What readiness should cover, when to involve your auditor, which gaps matter most, and how readiness, Type 1 and Type 2 can work as one continuous engagement. A practical guide to preparing for a report your customers can rely on.
CPA firm registration, signing licenses and peer review are the starting point, not proof of quality. A practical guide to checking credentials and asking the questions that matter before choosing your SOC 2 auditor.
Neither is better for everyone. The right choice depends on your customers, how you run security and where you are headed. For AI-native and AI-centric companies, SOC 2's flexible criteria usually make it the stronger starting point.
There's a basic psychology behind why most people don't like audits. Fix this, and people are surprisingly happy to do them again.
Enterprise buyers use SOC 2 as an initial qualifier, then look deeper. A quality report is what carries you through that assessment and turns your compliance investment into real trust.
Audit quality isn't service quality, and it isn't only professional standards. The real test is whether a reader of your report thinks: this tells me what I need to know.
Enterprise security teams review you in the background and rarely give feedback. What they look at beyond SOC 2, what counts as a genuine pen test, and how a quality report does the heavy lifting.
Compliance from first principles, the 95% problem, the compliance metadata AI needs, rethinking screenshots, spreadsheets and policies, and why audits should meet clients where they are.