SOC 2 Type I vs Type II: what your enterprise customer actually wants

A SaaS company lands its first enterprise deal. Procurement comes back with a security questionnaire and a request for a SOC 2 report. The founder searches for “SOC 2” and finds a menu of options, Type I, Type II, Trust Services Criteria, bridge letters, attestation, CPA firms, readiness guides. Most of the explanations online are either marketing from audit firms or simplified to the point of being wrong.

The practical question behind “do you have SOC 2” is usually “can you show me independent evidence that your security controls actually work.” Understanding which SOC 2 report answers that question, and at what cost and timeline, decides whether the deal closes on time.

What SOC 2 actually is

SOC 2 is an attestation report produced by a licensed CPA firm, assessing a service organization’s controls against a defined set of Trust Services Criteria. The criteria cover five categories:

• Security (required in every SOC 2)
• Availability
• Processing Integrity
• Confidentiality
• Privacy

Most mid-market SaaS companies pursue Security and Confidentiality. Availability matters for uptime-sensitive services. Processing Integrity matters where transaction accuracy is critical. Privacy adds GDPR and CCPA-adjacent controls.

Type I vs Type II, the core difference

The difference comes down to time.

Type I describes the controls in place at a single point in time. The auditor evaluates whether the controls are designed appropriately and are implemented as described on the report date.

Type II describes the operating effectiveness of controls over a period of time, usually 6 or 12 months. The auditor samples evidence across the period to confirm each control operated as intended.

A Type I report proves the controls exist. A Type II report proves the controls worked consistently.

Enterprise buyers almost always want Type II eventually. Type I is useful as an interim step for buyers willing to accept that your program is new.

When Type I makes sense

Type I is the right first step when:

• You are pursuing your first enterprise customer and the program is less than 6 months old
• A buyer has explicitly accepted Type I as sufficient for the initial deal with a commitment to Type II within 12 months
• You need a defensible artifact quickly and the budget for a full Type II audit is not available yet
• You are pre-revenue or early-revenue and raising capital alongside the audit

Typical Type I timeline from readiness start to report issuance: 3 to 6 months. Typical cost from the CPA firm: $15,000 to $35,000 for a mid-market scope.

When Type II is the real target

Type II is what enterprise procurement actually wants, because it shows evidence over time. Reasons to go straight to Type II:

• The buyer has explicitly said “Type II report required”
• You are selling into regulated industries where examiners or auditors are downstream
• You have been operating the control environment for 6+ months and a short observation-period Type II is feasible
• You have the budget to accept a longer runway

Typical Type II timeline: 6 to 18 months from readiness start, depending on observation period. Typical cost: $35,000 to $100,000 for the audit itself, plus the readiness work beforehand.

The readiness engagement is where most of the work happens

The audit itself is a few weeks of auditor time. The readiness work that makes the audit reach a clean opinion is 3 to 9 months of controlled setup, documentation and evidence accumulation.

A typical readiness engagement covers:

• Scoping. What systems and data are in the audit boundary. What Trust Services Criteria apply. What is explicitly carved out.
• Gap assessment. Current state of each in-scope control, documented.
• Remediation. Building or hardening controls that are missing or weak. MFA, logging, access reviews, change management, vendor-risk, incident response.
• Documentation. Policies, procedures, system descriptions.
• Evidence accumulation. Monthly logs, access review records, vulnerability scan outputs, tabletop records. This is the material the auditor samples.
• Pre-audit readiness review. A dry-run against the audit scope to catch issues before the auditor does.

A firm that skips readiness work and goes straight to audit finds expensive ways. Qualified opinions, report delays, rework cycles.

Who does what

A practical division of labor:

• Your MSP or IT partner. Builds and operates the control environment. Maintains evidence. Advises on scope and design. Does not issue the report.
• The CPA audit firm. Runs the audit. Issues the report. Independence rules prohibit the audit firm from running the program they are auditing.
• Your GRC tool, optionally. Vanta, Drata, Secureframe, Thoropass. Useful for automating evidence collection once the program exists. Not a substitute for a real program.

Atticus Rowan operates in the first category. We guide companies preparing for SOC 2 Type I and Type II audits, building the control environment, operating it long enough to produce the evidence the auditor needs and coordinating with the SOC 2 audit firm. We are not a SOC 2 audit firm ourselves. We are the MSP that makes the audit reach a clean opinion.

How to decide which report to pursue

The decision tree:

1. Does the buyer require Type II? Pursue Type II.
2. Does the buyer accept Type I now with a Type II commitment later? Pursue Type I first, schedule Type II 6 to 9 months out.
3. Is the program less than 6 months old? Type I is your realistic first step.
4. Has the program operated cleanly for 6+ months? Type II is feasible directly.
5. Is budget tight and a full Type II audit out of reach? Type I buys 12 months of credibility while you build toward Type II.

A common sequence we see: readiness engagement, Type I report, 12 months of operation, Type II report. That sequence is defensible and produces a progressively stronger artifact for each subsequent enterprise deal.

What to do before calling an audit firm

Call the MSP first. The reason is simple. An auditor walking into a program that is not ready will either decline the engagement, issue a qualified report or run a long rework cycle that delays the report and burns the fee. A readiness engagement avoids all three outcomes.

If your company is facing a SOC 2 request from an enterprise customer and you need to decide between Type I, Type II or a phased approach, schedule a discovery call. We can scope the readiness timeline against your deal pressure and your budget.