PW-SOC2-011
Starting SOC 2 Type 2 after Type 1 (observation window handoff)
How to enter the Type 2 observation window after Type 1 without dropping weekly evidence rhythm.
PW-SOC2-001 SOC 2 readiness spoke · Decide · 2/7
SOC 2 Type 1 vs Type 2 for seed startups
TL;DR. Type 1 attests design of controls at a point in time; Type 2 attests operating effectiveness over an observation window. Seed startups usually start with Type 1 to unblock procurement, then run a 3–12 month window into Type 2—unless a named enterprise deal requires Type 2 first.
Claim ladder Material statements on this page are labeled Verified, Inferred, or Unknown per editorial standards.
Key terms: Type 1, Type 2, observation window.
On this page
What each report type actually proves
A Type 1 report describes your system and opines on whether controls are suitably designed as of a specified date. A Type 2 report covers a period—the observation window—and opines on whether those controls operated effectively over that period.
Buyers use Type 1 to confirm you have a real control environment. They use Type 2 to confirm you can sustain it. Enterprise security teams increasingly prefer Type 2, but many seed deals still clear with Type 1 plus a dated roadmap.
The usual seed default
Unless a live RFP explicitly demands Type 2, most seed SaaS teams should:
- Scope Security (Common Criteria) first.
- Drive a Type 1 within one quarter.
- Start the Type 2 window the day Type 1 fieldwork closes—or earlier if controls already run.
Skipping straight to Type 2 can make sense when a lighthouse customer will not sign without it and you already have months of clean evidence. That is the exception, not the plan on a whiteboard.
Not sure you should start yet? Read when to start SOC 2 before you buy tooling or book an auditor.
Tradeoffs founders feel
| Dimension | Type 1 | Type 2 |
|---|---|---|
| Time to first report | Weeks to a few months after readiness | Window length + fieldwork |
| What it unblocks | Many mid-market security reviews | Stricter enterprise / renewals |
| Failure mode | Controls exist only on paper | Missed reviews during the window |
| Cost shape | Lower auditor fee; still real internal load | Higher fee; sustained ops cadence |
Questions founders ask
Is Type 1 enough to close enterprise deals?
Sometimes for mid-market; many enterprises still accept Type 1 with a Type 2 date. Ask the buyer’s security questionnaire, not Twitter.
Can we go straight to Type 2?
Yes if controls already operate and a buyer demands it—but you still need the observation window length.
Does Type 1 expire?
Reports are point-in-time / period-specific. Buyers care about recency and whether you continued into Type 2.
Sources
- primary SOC 2 — SOC for Service Organizations: Trust Services Criteria — AICPA & CIMA — Official SOC 2 topic landing; defines SOC 2 as examination of controls relevant to TSC categories.
- primary 2017 Trust Services Criteria (With Revised Points of Focus – 2022) — AICPA & CIMA — Authoritative TSC document (Security/Availability/Processing Integrity/Confidentiality/Privacy).
Linear path
← Path: When seed startups should start SOC 2 (deal pressure, not theater)
Next in path: 90-day SOC 2 Type 1 checklist for SaaS founders →