SOC 2 Type 1 or Type 2?
Four quick questions about your buyer's deadline, your team and your controls. See both paths on one timeline. No signup.
Most companies should go straight to a SOC 2 Type 2, because it is the report most buyers ask for. A Type 1 is the option when a prospect needs a report in under about 3 months. A Type 1 checks that your controls are designed well on a single day. A Type 2 checks that they kept working over an observation window, usually 3 months for a first report. Doing both means paying for two audits, which pays off only when a deal cannot wait.
This tool asks four questions: your buyer's deadline, whether they will accept a Type 1, your team size and how many controls you already have. It then lays out both paths on one timeline, with months to a report and audit fees for each. To see what your whole SOC 2 program could cost, try the free cost calculator next.