SOC 2 Type I vs Type II
What a SOC 2 Report Covers
SOC 2 is an auditing framework developed by the American Institute of CPAs (AICPA). It examines how a service organization protects customer data. A SOC 2 report is written by an independent certified public accountant (CPA) firm after it tests the organization's controls against the Trust Services Criteria. The report is usually shared with customers and prospects under a non-disclosure agreement.
The Trust Services Criteria group controls into five categories. Security is always included. The others, availability, processing integrity, confidentiality and privacy, are optional and chosen according to the services provided. A hosting company may include availability because uptime matters to its customers, and confidentiality if it stores sensitive records.
Type I vs Type II: A Snapshot or a Track Record
A Type I report describes whether a provider's controls are suitably designed and in place as of one specific date. It shows what the controls are and that they exist at that moment, but it does not show whether they worked consistently.
A Type II report covers a period of time, commonly several months and often up to a year. It describes the same design and also tests whether the controls operated effectively throughout that period. For most customers, a Type II report gives stronger evidence, because a control that worked on one day does not show it worked every day.
How Customers Use SOC 2 Reports in Provider Reviews
When choosing a provider, a business often requests the latest SOC 2 report during a security review. The reader then checks the scope, meaning which services and locations were included, the trust criteria covered, the period tested and any exceptions the auditor noted. An exception means a control did not operate as designed during the period. It is not automatically serious, but it should be understood.
Scope matters as much as the report type. A report may cover a hosting platform but not a separate billing system. Customers should also check how the provider's own suppliers are handled, including a data center operator. The physical side of that relationship is covered in data center physical security.
Frequently asked questions
Is a SOC 2 report the same as SOC 2 certification?
No. SOC 2 is not a certification or a pass mark. It is an attestation report, meaning a CPA firm reports its findings about an organization's controls. There is no official SOC 2 certificate. A provider that says it is SOC 2 certified usually means it has a report, so the reader should ask to see the report and the period it covers.
How does SOC 2 compare with ISO 27001?
SOC 2 and ISO 27001 both help customers judge a provider's security, but in different ways. A SOC 2 report is written by an auditor about a provider's controls for a specific scope and time period, and it is usually shared privately. ISO 27001 is a certification of an information security management system against a published international standard. Many providers hold one or both, and the right choice depends on the buyer's contractual and regulatory needs. See ISO 27001 for hosting for more detail.