What is a SOC 2 Type I report?

‍

A SOC 2 Type I report attests to a company’s security rules (“controls”) at a specific point in time. The Type I report describes the controls a company follows but does not judge the effectiveness of those controls. 

A SOC 2 Type I report is issued as of a specific date and represents an auditor’s review and approval of a company’s systems at that moment in time. For example, a Type I report is like an auditor saying, “I checked the company’s security controls on September 30, and everything looked good.”

There are two types of SOC 2 reports:
‍

• Type I describes a vendor’s systems and whether their design is suitable to meet relevant trust principles as of a specified date.
• Type II details the operational effectiveness of those systems throughout a specified period.

Obtaining a Type I report is faster, while a Type II report is more detailed and trusted. Customers and prospects generally prefer—and sometimes even require—a SOC 2 Type II report.