SOC 2 Type 1 or Type 2 first?
Updated
Ask the buyer, in writing, which report they accept, then pick. Type 2 is the usual ask from enterprise, financial services and healthcare buyers, and Type 1 is a bridge for a deal that cannot wait (Scrut) (Jones IT). The two sources we read disagree on how often Type 1 is enough, and both sell compliance help, so treat their shares and fees as one vendor's view. This page lays out what each report proves, where the sources differ, and the question that settles it.
What each report proves
A Type 1 report describes whether your controls are suitably designed at a single date. A Type 2 report also tests whether they operated over a period. Jones IT says Type 1 has no observation period and that the audit takes 2-6 weeks once the company is ready, while Type 2 runs over a window of 3-12 months (Jones IT). For how long the window should be, see the observation period guide.
Where the sources disagree
| Question | Scrut (updated 20 Aug 2026) | Jones IT (dated "Mar 7", no year) |
|---|---|---|
| Do buyers accept Type 1? | Financial services, healthcare, government and M&A diligence buyers do not; mid-market SaaS buyers "rarely" do | "Nine times out of ten" the prospect requires Type 2 or its vendor-risk team accepts only Type 2 |
| Skip Type 1? | About 70% of organizations do, based on one person's experience; no wider study cited | Type 1 can fit: written customer acceptance, a 2-3 month trust-signal need, or a tight budget |
| Type 1 fee | $10,000-$30,000 | $10,000-$30,000 |
| Type 2 fee | $30,000-$80,000+ | $25,000-$100,000+ |
| Minimum Type 2 window | 3 months; 6 months "industry-recommended" | 3 months; 6 common; 12 strongest |
| Age limit on a Type 1 | Not stated | Most enterprise buyers will not accept one older than 3-6 months without more attestation |
Scrut sells a GRC platform and Jones IT sells readiness and remediation services, so neither is a neutral study. Fee ranges depend on company size and auditor, and your CPA firm's quote is the number that counts. For the full cost picture see SOC 2 cost for startups.
The case for going straight to Type 2
Scrut argues that a direct Type 2 path gets you to the report the market wants faster and cheaper overall, if your controls have run for 3 months or more and your buyers are mid-market, enterprise, regulated or government (Scrut). The logic is simple: if the buyer will ask for Type 2 anyway, a Type 1 is a second engagement you pay for first.
The case for Type 1 first
Jones IT names the cases where Type 1 may be enough: a pre-Series A company with an immediate enterprise opportunity, a customer who accepts it in writing, a pilot that needs a trust signal in 2-3 months, a budget that cannot carry Type 2 yet, or a wish to check control design before a long observation window (Jones IT). Even then, the same article warns the report may not clear procurement.
The one question that settles it
Email the buyer's security contact: "Will you accept a SOC 2 Type 1 report, or do you require Type 2? If Type 2, what observation period and how recent?" Their answer beats every percentage above. If they accept Type 1 only with a date for Type 2, a bridge letter and a plan from the SOC 2 timeline help. If they asked for a report and you have none yet, start with what to do when a customer asks for SOC 2, and for the interim see answering a questionnaire without a report.
What stays the same either way
The policies, the access reviews, the vendor records and the evidence habits are the same for both reports; the auditor looks at them once or across a period. Starting now is the work that pays off under either choice. See Type I vs Type II policies and how long a finished report stays useful in how long a SOC 2 report is valid.
Frequently asked questions
- Is a SOC 2 Type 1 report worth getting?
- It depends on one buyer's answer. Jones IT lists cases where it may be enough: a specific customer who accepts Type 1 in writing, a pilot that needs a trust signal in 2-3 months, or a budget that cannot support Type 2 yet. Scrut says finance, healthcare and government buyers do not accept it. Both sell compliance services or software. Ask the buyer which report they accept before you pay for either.
- Do I need a Type 1 before a Type 2?
- Neither source says you must. Scrut says about 70% of first-time organizations skip Type 1, citing one person's experience and no wider study. Jones IT describes Type 1 as a way to validate control design before a long observation period. Nothing in either article makes Type 1 a prerequisite; the choice is about timing and what the buyer accepts.
- How old can a SOC 2 report be before a buyer rejects it?
- Jones IT says most enterprise buyers will not accept a Type 1 report older than 3-6 months without additional attestation, and that a Type 2 report is typically considered valid for 12 months. Those are one vendor's statements, not a rule. The buyer's vendor-risk team sets the actual cutoff, so ask for it.
- Can a bridge letter cover the gap?
- A bridge letter is a statement from management about the period between the end of a report and today. It extends the story of a report you already have; it does not turn a Type 1 into a Type 2. The bridge letter template on this site shows the format.
- How long is the Type 2 observation window?
- Jones IT says 3 months is the minimum, 6 months is common and 12 months gives the strongest assurance. Scrut gives 3 months as the minimum and calls 6 months the industry-recommended standard. Your CPA firm sets the window for your engagement.
- Do the policies change between the two reports?
- No. Both reports test the same controls, so the policy set and the evidence habits are the same. The difference is when the auditor looks: one date for Type 1, a period of time for Type 2. The Type I vs Type II policies guide covers what each needs from your policies.
Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.