Blog · SOC 2 · July 2026
SOC 2 Type I vs Type II: the timeline that holds up in fieldwork.
Type I answers “are controls designed?” Type II answers “did they operate?” Most enterprise buyers want the second. Here is how to sequence without burning the observation period.
If you are preparing your first SOC 2, the Type I vs Type II choice shows up early: sales wants a report for a deal, auditors want a clean period, and engineering wants to know when monitoring must be real. Getting the sequence wrong is expensive.
Type I: design at a point in time
A Type I report describes whether controls are suitably designed as of a specific date. It can unblock early conversations, but it does not prove operating effectiveness. Treat it as a bridge, not the finish line, if your ICP is US enterprise.
Type II: effectiveness over a window
Type II samples evidence across a review period, often six to twelve months. Access reviews, change tickets, alerts, and policy acknowledgments must exist throughout that window. Discovering a missing control mid-period usually means extending the window or accepting a finding.
A practical sequence
- Import SOC 2 templates and connect IdP, cloud, and source control before the observation period starts
- Close critical gaps (MFA, logging, backup, change control) so the period is not spent firefighting design issues
- Keep evidence continuous: prefer integration-backed tests over one-off screenshots
- Align PBC lists with your auditor early so fieldwork maps to lineage you already have
Axovern is built for that sequence: readiness score and ranked gaps on day one, continuous monitoring during the period, and auditor collaboration on the same graph when fieldwork starts. See also What is SOC 2? and First SOC 2.
Do buyers accept Type I?+
Some early-stage or mid-market buyers will. Most enterprise procurement teams ask for Type II covering a recent period.
How long should the Type II period be?+
Common windows are six or twelve months. Confirm with your CPA firm and sales timeline before you start the clock.
Can we run Type I then Type II?+
Yes. Many teams issue Type I after design is solid, then run Type II once monitoring and evidence are continuous.