A customer's security team has written "send your SOC 2", and you don't have one. SOC 2 isn't a law and it isn't a certificate. It's an attestation (Bastion's framing), a report written by an independent CPA firm about your controls. SOC 2 reports come in two types. Vendors describe a Type 1 as a report on the design of your controls at a point in time, and a Type 2 as covering that design plus whether the controls operated effectively over a period.
Every figure and position below comes from vendors who sell in this space. We name each one where it's used, and anything that's our judgment says so.
What is the difference between SOC 2 Type 1 and Type 2?
The difference is time. SOC 2 reports cover whichever of the Security, Availability, Processing Integrity, Confidentiality and Privacy categories you chose, and in both types the auditor examines your controls against them. Type 1 asks whether the controls are designed properly on one date. Type 2 asks whether they worked, day after day, through a window.
| Aspect | Type 1 | Type 2 |
|---|---|---|
| Period covered | One date | A window of months |
| What the auditor tests | Design of controls | Design and operating effectiveness |
| Earliest you can have it | Once controls are in place | After the window closes and the audit is done |
| How buyers tend to read it | Evidence you've started | The credential Scrut calls the commercial one |
The "earliest you can have it" row is our judgment. The last row is one vendor's view, not a market survey. Scrut says "Type 2 is the commercial credential" but also that which report a buyer accepts "depends almost entirely on who the buyer is." OneUptime makes the sharper point about why a Type 1 can fall short: "Type I does not contain an opinion on operating effectiveness throughout a period." A buyer who wants to know your controls hold up in practice gets no answer from a Type 1.
On cost, we're not going to print a range. Scrut's ranges are $10,000-$30,000 for Type 1 and $30,000-$80,000+ for Type 2, and other vendors publish different ones. Treat any number as a starting point for a quote request.
Which report should a startup get first?
Ask the customer before you choose.
The vendors split on the underlying question. Scrut leans toward Type 2 as the credential that closes deals. Bastion argues that doing a Type 1 first adds audit cost for a similar total timeline. OneUptime notes that a Type I contains no opinion on operating effectiveness, which is why a buyer asking for Type II may not accept it. The vendors agree on less than the comparison pages suggest, and each has something to sell.
Here's a decision rule. It's our judgment, not a sourced finding.
- The contract or security addendum says "Type II": go to Type 2. Use a Type 1 as a stopgap only if the customer agrees to that in writing.
- The customer wrote "SOC 2 report" with no type, or sent a questionnaire that mentions SOC 2: ask which they accept, and when.
- Nobody has asked yet and you're guessing: don't buy a Type 1 as insurance. Build the controls, and let the first real request tell you what to commission.
If you're also weighing ISO 27001, that's a different decision, covered in when a startup should certify for ISO 27001. This page assumes SOC 2 is the one the customer wants.
What should you ask the enterprise customer before you pay an auditor?
OneUptime's guide to choosing between the types lists the questions worth asking. We've reworded them as a script. Send these in writing, because you want the answers on file.
- Is a Type 1 acceptable now, and does that change before signature or before production data moves?
- Which parts of the product, hosting and support do they expect in the system description?
- Do they want categories beyond Security, such as Availability or Confidentiality?
- How recent must the report period end be, and would a bridge letter cover the gap?
- Do they require an independent CPA firm's report rather than a readiness assessment?
- If a Type 2 is in progress when you sign, what will they accept in the meantime?
In our judgment, question 3 matters more than it looks. Each extra category adds controls to test and lengthens the preparation. In our view customers sometimes ask for more categories than they need, so ask what the requirement is. Question 2 sets the boundary of the report, and the boundary is where contractors enter, which we get to below.
How long is the observation period, and what happens while it runs?
A Type 2 report covers an observation period, and that period is what sets your date. Scrut states the minimum plainly: "The minimum observation period is 3 months." Scrut calls 6 months the industry-recommended standard and 12 months the broadest assurance, so check question 4 above before you plan around the minimum.
Bastion's view is that the window starts when your auditor confirms readiness, with core controls roughly 90% implemented, and that the full journey, preparation plus window plus report, runs 4.5-6 months. That's a vendor's estimate. The practical point holds either way: you can't buy your way around the period. An auditor can't observe three months in less than three months.
Bastion also says new joiners and contractors can be added while the window is open. That sounds like good news, and it is, with a catch we cover in the contractors section.
Bastion adds that Type 2 reports are often treated as stale after about a year, so expect to renew on a cycle, not once.
What is a bridge letter, and will procurement accept it?
A bridge letter covers the gap between the end of your last report period and a date you state. Say your Type 2 period ended in March and the customer is signing in May. As we read it, the letter states that nothing material has changed since.
Two details from the sources. OneUptime says it's generally "a management representation rather than an extension of the service auditor's opinion", so a buyer is entitled to weigh it as a statement from the company being audited. Secureframe says management signs it, with no involvement from the CPA firm, and that "Bridge letters typically don't cover a period of more than three months." Beyond that, in our judgment, expect pushback.
Don't confuse it with an "in-progress" letter. Bastion says auditors can issue letters confirming the audit engagement, the controls in scope, the expected completion date and current status. Whether a given buyer accepts one is their call, and your auditor decides what they will issue, so ask before you promise one.
If a Type 2 is still in progress, OneUptime's interim options are a Type I report, an engagement letter with the audit firm, readiness assessment results, or another package agreed in writing. Whether any of those works is the customer's call, which is why question 6 is worth asking early.
How do contractors and nearshore engineers show up in a SOC 2 report?
For the scope test and the per-row answers, use how to answer the contractor questions on a security questionnaire. Here are the parts that depend on the report type.
An individual contractor is a person in the system. Drata's guidance is that a contractor is in scope if they affect the audited system, and the auditor has the final say. In our judgment, a Type 2 sample will cover people who joined or left during the period, so a freelancer who joins in month two needs onboarding evidence from their first day: the signed agreement, the access request, the approval. Bastion's point that contractors can be added during observation is true, but in our judgment, paperwork created after the fact is weaker evidence than paperwork dated at onboarding.
Departures count as well. In our judgment, a Type 2 auditor will want evidence that access was removed for the leavers they sample, while a Type 1 looks at whether an offboarding process exists on the date. If your offboarding lives in someone's memory, fix that before the window opens, not during it.
A staffing vendor is a different case. If an agency's controls are part of what you rely on, it may be a subservice organization. Compass ITC defines that as "a third-party service provider whose services are part of the service organization's information system". Two methods follow. Under carve-out, "the service organization explicitly excludes the subservice organization from the scope of its SOC report". Compass ITC says a carve-out report must still name the subservice organization, describe its services, specify the excluded controls and identify the complementary subservice organization controls. Under the inclusive method, "the subservice organization is included within the scope of the service organization's SOC report".
Compass ITC's page doesn't address individual contractors, so applying this to a staffing agency is our reading. The question to take to your auditor is whether the agency's engineers are your personnel (you manage their access directly) or its (the agency manages them). Which way it goes decides whose evidence the auditor asks for. Whether a vendor counts is a question for your auditor. The Compass ITC test is whether the vendor's services are part of the system the report describes, so a provider can qualify even when it isn't a staffing agency.
What this means for your next enterprise deal
The decision is which report to commission and when to start the clock. Get the customer's acceptance in writing first. If they want Type 2, start the observation window as soon as your controls are in place, because the window, not the audit fee, sets the date the report exists.
Before it opens, list every non-employee with repo, CI or production access, and settle how each is scoped. That's our judgment, not a sourced rule, but it's the cheapest step available: the list answers the scope question, the onboarding evidence question and the offboarding question in one pass. Remove access nobody can justify.
For the access list and exit evidence an auditor will sample, use the contractor onboarding and offboarding checklist. The wider contracting picture sits in EU engineering hiring compliance: contracts, IP and GDPR, and the legal requirements for hiring developers in Europe covers the law behind engaging engineers there.
FAQ
Is SOC 2 Type 1 enough for an enterprise customer?
Sometimes, if the customer says so. A Type 1 covers control design on one date and, as OneUptime puts it, contains no opinion on operating effectiveness over a period. Buyers who ask for a Type II may not accept it. Get their position in writing before you rely on it.
How long does a SOC 2 Type 2 take for a first-time startup?
Longer than the observation window alone. Scrut gives a minimum window of 3 months, and Bastion's view is that preparation and the audit add to that. Both are vendors, so treat the totals as estimates. Your date is set by when controls are in place and the window opens.
Do you need SOC 2 Type 1 before Type 2?
No. Nothing requires a Type 1 first. Bastion argues that doing one first adds audit cost for a similar overall timeline. It can still help if a customer will accept it as an interim step, so ask them before you decide.
Can you sell with a bridge letter or an in-progress SOC 2?
Sometimes. A bridge letter, per Secureframe, is signed by management and typically covers no more than three months. OneUptime lists an engagement letter or readiness results as interim options for an in-progress audit, if the customer agrees in writing. Whether it works is their call, so ask early.
Do contractors have to be included in a SOC 2 audit?
If they affect the audited system, usually yes, and in a Type 2 the auditor may sample them across the whole period. A staffing agency may instead be a subservice organization, handled by carve-out or inclusive method. Your auditor decides.