SOC 2 Type 1 vs Type 2: Which Report US Buyers Expect

• Done for you, end to end

  We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.

• Simple and quick

  A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.

• 8,100+ client engagements

  In 60+ countries over 20+ years, with experts who bring 30+ years of experience.

• Under US$10,000, all-inclusive

  For most start-ups and SMEs: SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001, including the independent audit. A fixed quote follows a free gap assessment.

Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:

• Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
• Sterling Academy: preferential course access, with complimentary awareness training for your people.
• Internal auditor training for your audit team, as applicable to your standard.
• For information-security engagements, a vulnerability assessment.

These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.

Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.

Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.

What the fee covers, and what it doesn't:

• It is the fee for your first SOC 2 report or your first certification only.
• Annual work is always additional and billed the following year: later SOC 2 report periods, and ISO surveillance and recertification audits.
• It assumes a typical start-up or SME scope: one product or service and one main location.
• Larger or multi-site scopes get a fixed quote after the gap assessment.
• PCI DSS is quoted separately: a fixed quote follows a free gap assessment.

^[1] Occupational Employment and Wage Statistics, May 2025: 15-1212 Information Security Analysts, national annual median wage. US Bureau of Labor Statistics. accessed October 23, 2026.

The outcome. You pick the right report the first time, avoid paying for an examination your buyer will not accept, and close the deal on schedule.

The AICPA notes that customers often request a SOC 2 report because they need information about the design, operation and effectiveness of a supplier's controls^[1]. Those three words map neatly onto the two report types: design is what a Type 1 speaks to; operation over time is what a Type 2 adds.

US regulated buyers have reasons to prefer evidence over time. Financial institutions under the FTC Safeguards Rule must periodically assess service providers based on the risk they present and the continued adequacy of their safeguards^[2]. The rule does not name SOC 2. In Sterling's experience, a Type 2 is how many US suppliers give that kind of reviewer evidence that controls kept working.

The AICPA publishes illustrative materials for both, including a management representation letter for a Type 1 and a service auditor's report for a Type 2^[3][4]. As commonly described:

The outcome. Your report answers the reviewer's question at first reading, with no follow-up round.

• Reading a Type 1. The reviewer learns your controls are described and were designed to meet the criteria on the report date. Useful, but it says nothing about next month.
• Reading a Type 2. The reviewer learns a CPA firm sampled across months and found controls operating, or noted exceptions. It reads as stronger because it shows behavior, not intent.
• Where they look first. The opinion, the scope statement, the period and any exceptions.

In Sterling's experience, US contracts and questionnaires often name "Type 2" or a minimum period. When a buyer names a type, treat it as a requirement. When a buyer simply wants "SOC 2", ask what decision the report supports before you choose.

The outcome. A report in hand weeks sooner, with the Type 2 already lined up behind it.

• Near deadline. A named US customer has a close date and has said an interim report is acceptable.
• Clean baseline. You want the CPA firm to confirm design before months of evidence build up.
• Fresh controls. Your control set is recent and you want an independent check early.
• Forcing date. Your team needs a fixed date to finish preparation.

The trade-off: a Type 1 is an extra examination. You prepare for it and still need a Type 2 later. If the buyer would accept a dated plan and a completed questionnaire, skip it.

The outcome. One examination to reach the report most US buyers want.

Go straight to a Type 2 when buyers have asked for it, when your controls already run, or when the observation period can open within weeks. The start date of the period is the biggest single factor in when the report exists; our SOC 2 timeline guide lines the stages up. If you handle sensitive customer data or sell to regulated US industries, stopping at a Type 1 rarely pays.

Both share a layout. Management's description of the system comes first, prepared against the AICPA description criteria^[5]: the services, infrastructure, software, people, procedures and data, and the controls in place. Then the CPA firm's opinion, followed by the tests and results. A Type 2's testing section is longer, because samples span the period and each exception appears with management's response.

The AICPA's illustrative Type 2 report reflects SSAE-21, effective for service auditor reports dated on or after June 15, 2022^[4]. Your system description is the yardstick the whole examination uses, so accuracy there protects you under either type.

Plan the Type 2 before the Type 1 is issued. Anything done once for the examiner, such as a single access review, now becomes a recurring task with an owner and a due date. Teams that treat the Type 1 as a finish line slip in the following weeks, and the first Type 2 period opens with exceptions. Effivity holds that calendar, reminds owners and collects evidence, and the same calendar carries every annual renewal.

Report type and Trust Services categories are separate choices: a Type 2 on security alone is as valid as a Type 1 across several categories^[6]. Cost follows scope, boundary and readiness more than type; see the SOC 2 cost guide. Sterling's all-inclusive fee covers your first SOC 2 report, whichever type you choose, within the conditions in the pricing note on this page. Choosing a Type 1 and then a Type 2 means two examinations, which the fixed quote sets out after the free gap assessment.

• Overstating. Calling a Type 1 a Type 2 in a questionnaire; reviewers notice.
• Choosing blind. Picking a type before asking the buyer what it needs.
• Opening the period early. Starting before controls are reliable, which writes exceptions into your first report.
• Treating the report as permanent. Both types describe a date or a period; US buyers want a current one. Our bridge letter guide covers the months between periods.

This is Sterling's recommendation, not an AICPA rule:

1. Ask the buyer first. If the contract or questionnaire says Type 2, plan a Type 2. 2. If nothing is named, still plan for a Type 2; it is what most US security teams end up wanting. 3. Use a Type 1 only when a dated customer need cannot wait, and open the Type 2 period right after. 4. Keep the first report to security alone; widen it only when a buyer requires it. 5. Describe your status in words that are exactly true: preparing, Type 1 issued, Type 2 period under way, Type 2 issued.

For fundraising context, see SOC 2 for Series A and the SOC 2 hub. Know which report your buyer wants? Get a proposal for the path that fits your deadline.

A SOC 2 engagement has one deliverable that no consultant can hand you: the report. The SOC 2 report is issued by a US-licensed CPA firm, as AICPA standards require^[1]. What Sterling does is make sure you get there ready, and that nothing between today and the report lands on your desk.

With Sterling, you deal with one team from start to finish. We coordinate:

• a readiness review and a gap assessment against the Trust Services Criteria;
• the policies, procedures and controls you need, written for how your company actually works;
• evidence collection, so the examination does not become a scramble;
• an internal audit before the examiner arrives, carried out by people who did not advise you on the controls;
• the Type 1 or Type 2 path that fits your deal timeline, and the examination itself, including scheduling, requests and follow-ups.

Our experts bring 30+ years of experience, and the firm has completed 8,100+ client engagements in 60+ countries over 20+ years. You get a single plan, a single point of contact and a clear view of what happens next.

^[1] SOC (System and Organization Controls) Suite of Services. AICPA & CIMA. accessed October 23, 2026.

• SOC 2: standard overviewStandard overview
• Clear US Enterprise Security Reviews and Questionnaires FastUnited States
• SOC 2 Timeline for US Start-ups: How Long Each Stage TakesUnited States
• SOC 2 Cost for US Start-ups: What You Pay and What Changes ItUnited States
• SOC 2 Bridge Letters: Covering the Gap for US CustomersUnited States
• SOC 2 for Series A: What Founders Need and WhenUnited States
• Sterling in the United StatesUnited States

1. SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy. AICPA & CIMA. accessed October 26, 2026.

2. 16 CFR 314.4 Elements (Standards for Safeguarding Customer Information). eCFR, Office of the Federal Register. accessed October 26, 2026.

3. Illustrative Management Representation Letter: SOC 2 Type 1. AICPA & CIMA. accessed October 26, 2026.

4. Illustrative Service Auditor's SOC 2 Type 2 Report. AICPA & CIMA. accessed October 26, 2026.

5. 2018 SOC 2 Description Criteria (With Revised Implementation Guidance - 2022). AICPA & CIMA. accessed October 26, 2026.

6. 2017 Trust Services Criteria (With Revised Points of Focus - 2022). AICPA & CIMA. accessed October 26, 2026.

The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.

Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.

Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.

Standards and marks named on this site belong to their respective owners.