PW-SOC2-001
SOC 2 Type 1 vs Type 2 for seed startups
When seed SaaS should pursue Type 1 vs Type 2, what each proves, and how buyers usually sequence them.
PW-SOC2-011 SOC 2 readiness spoke · Answer buyers · 7/7
Starting SOC 2 Type 2 after Type 1
TL;DR. Treat Type 1 as the starting gun for operating effectiveness. Keep control owners, calendared reviews, and evidence pulls running through the entire window. Shorten or lengthen the period based on buyer pressure and how stable your controls already are.
Claim ladder Material statements on this page are labeled Verified, Inferred, or Unknown per editorial standards.
Key terms: observation window, Type 2, Type 1.
Educational handoff checklist — completing squares does not mean you are audit-ready. No localStorage.
TYPE 2 WINDOW · EMPTY
Observation window not started. Keep owners and weekly evidence rhythm running the day Type 1 closes.
On this page
The day after Type 1
Do not dissolve the compliance channel. Keep the same owners, the same review calendar, and the same evidence pack structure. Type 2 is mostly whether you kept doing the work.
Picking window length
- Shorter — strong existing cadence, urgent buyer Type 2 demand.
- Longer — still stabilizing reviews; want more samples of clean operation.
Changing people, IdP, or cloud accounts mid-window is possible but creates explanation load—plan migrations deliberately.
Print Type 2 handoff squares
Mark handoff readiness when printing. Progress is not stored.
- Window start date agreed
- Control owners still named
- Weekly evidence rhythm calendared
- Access / change / vendor reviews scheduled
- Buyer timeline mapped to window length
Questions founders ask
Can the Type 2 window start before Type 1 is issued?
Discuss with your auditor—operating periods can be planned deliberately.
What if we fail a control mid-window?
Remediate, document, and discuss; do not hide it.
Do policies need rewriting for Type 2?
Only if they drifted from practice—align paper to reality.
Sources
- primary SOC 2 — SOC for Service Organizations: Trust Services Criteria — AICPA & CIMA — Official SOC 2 topic landing; defines SOC 2 as examination of controls relevant to TSC categories.
- primary 2017 Trust Services Criteria (With Revised Points of Focus – 2022) — AICPA & CIMA — Authoritative TSC document (Security/Availability/Processing Integrity/Confidentiality/Privacy).
Linear path
← Path: What to send procurement in week 2 (SOC 2 in progress)