What is a SOC 2 Type I report?
A SOC 2 Type I report attests to a company’s security rules (“controls”) at a specific point in time. The Type I report describes the controls a company follows but does not judge the effectiveness of those controls.
A SOC 2 Type I report is issued as of a specific date and represents an auditor’s review and approval of a company’s systems at that moment in time. For example, a Type I report is like an auditor saying, “I checked the company’s security controls on September 30, and everything looked good.”
There are two types of SOC 2 reports:
- Type I describes a vendor’s systems and whether their design is suitable to meet relevant trust principles as of a specified date.
- Type II details the operational effectiveness of those systems throughout a specified period.
Obtaining a Type I report is faster, while a Type II report is more detailed and trusted. Customers and prospects generally prefer—and sometimes even require—a SOC 2 Type II report.
.png)
Join our Coffee and Compliance session, where our experts, Ethan Heller, GRC, Subject Matter Expert at Vanta, and Brad Dispensa,WWPS Specialist SA at Amazon Web Services (AWS) cover some of the challenges of SOC 2 compliance and show how Vanta and AWS work together to simplify and accelerate SOC 2 compliance.
Join our Coffee and Compliance session, where our experts, Ethan Heller, GRC, Subject Matter Expert at Vanta, and Brad Dispensa,WWPS Specialist SA at Amazon Web Services (AWS) cover some of the challenges of SOC 2 compliance and show how Vanta and AWS work together to simplify and accelerate SOC 2 compliance.
.png)
We had the pleasure of hosting Jeremy Epling, Vanta’s CPO from our Vanta Sydney office, where he shares and demonstrates some exciting new product updates designed to help security teams future-proof and scale their GRC programs more easily.
.png)
.png)
.png)
.svg)
.svg)
