Guide
SOC 2 Type 1: a snapshot of your controls on one day
A SOC 2 Type 1 report says your controls were designed properly on one specific date. So it is fast and cheaper, but it does not show the controls kept working afterwards.
- Preparation, not the examination
- A licensed CPA firm signs the report
- Plain-English guidance
What a SOC 2 Type 1 report proves
The CPA firm looks at your controls as of a single date and judges whether they are suitably designed. However, it does not test whether they operated over time. That is the job of a Type II.
Because of that, many buyers treat a Type 1 as a stopgap. Still, it is real evidence, and it can unblock a deal while a Type II is under way.
How long SOC 2 Type 1 takes
There is no watch period, so the timeline is short. The phases below come from typical first-time engagements.
| Phase | Typical time |
|---|---|
| Readiness and gap analysis | 1 to 2 months. |
| Remediation | Usually folded into readiness. |
| Fieldwork and reporting | 2 to 3 weeks. |
| Total | 1 to 3 months. |
Is SOC 2 Type 1 right for you?
Tick what applies. Several ticks suggest a Type 1 makes sense first.
Your result appears here as you tick, so you can see what is still open.
What SOC 2 Type 1 costs
The CPA firm's fee for a Type 1 usually runs $5,000 to $30,000. Preparation is separate, and our fixed fee runs $5,000 to $40,000 depending on scope and maturity. Also, the same scope can be quoted very differently by a boutique, a mid-tier firm or one of the Big Four.
When to choose SOC 2 Type 1
Ask your customer first, in writing. If they accept a Type 1, take it, because it is faster and cheaper. But if they insist on a Type II, going through a Type 1 first mostly adds cost rather than saving time.
- Choose it when a deal is blocked right now
- Choose it when the customer explicitly accepts it
- Skip it when the customer already refused one
What comes after
Most companies move to a Type II within a year, since nearly every enterprise buyer eventually expects one. The controls you built for the Type 1 then start their watch period. We are not a CPA firm, so we prepare you, while a licensed firm examines you. See the AICPA guidance on SOC 2.
SOC 2 Type 1 questions
Is SOC 2 Type 1 worth it?
Yes, when a customer accepts it and a deal is waiting. Otherwise, go straight to Type II.
Does a Type 1 expire?
It describes one date, so buyers often ask how old it is. Most expect a Type II later.
Can we fail a SOC 2 Type 1?
The CPA firm can issue a qualified opinion if controls are poorly designed, so readiness matters.
Is there a SOC 2 certificate?
No. There is no such thing as SOC 2 certification, only an attestation report.
Related guides
Prepare for SOC 2 Type 1 the right way
Tell us the customer request and your size. We reply with a written scope and a fixed preparation fee.
Scope your preparation