SOC 2 Type 1 vs. Type 2
A Type 1 report covers the design of your controls as of a point in time. It costs less and is available sooner.
A Type 2 report covers operating effectiveness over a period, typically three to twelve months for a first examination. Sophisticated buyers want a Type 2.
If a deal is waiting, a Type 1 can often unblock it while the Type 2 observation period runs. Many enterprise buyers accept a Type 1 with a committed Type 2 date. Some do not, so confirm with the specific buyer.
For a Type 2, evidence has to exist across the entire observation period. Companies that begin collecting evidence near the end cannot complete a Type 2 for that period. Late evidence collection is the most common reason a timeline slips.
Larson often recommends completing a Type 1 for your first year, because it allows you to provide a report to your clients quickly, with a lowered risk of reported exceptions (due to the “as of” date instead of testing for “operating effectiveness over a period of time”). Then, for your second report you can move to a Type 2, making sure that the controls that were tested for existence in the Type 1 are now operating effectively throughout the period. Make sure to check with your client’s auditor that they will accept a Type 1 for the current year.
SOC 2 Readiness Assessment
The readiness assessment determines whether your first report is clean.
We map your existing controls to the criteria, identify gaps, and give you a remediation list with a timeline and effort estimate. You fix the gaps before the examination, so they do not appear as exceptions in your report.
The assessment covers:
-
Governance and policy documentation
-
Risk assessment process
-
Access management and authentication, including multi-factor coverage
-
Change management
-
System monitoring and logging
-
Incident response
-
Vendor and subservice organization management
-
Business continuity and backup verification
-
Physical security, where applicable
-
Human resources controls, including onboarding, offboarding, and security training
The assessment also sets scope, and scope drives cost more than company size does.
SOC 2 and Compliance Automation Platforms
A compliance automation platform can make your job easier when it comes to gathering, organizing, and providing evidence to the auditor, however it usually does not make the examination more efficient.
We still perform the same examination, test the controls, evaluate whether the evidence supports each control, and issue the report. We work alongside many common platforms.
A platform showing all green does not guarantee a clean report. Platforms monitor what they are configured to monitor. Scope and control design fall outside that.
How much does a SOC 2 audit cost?
Scope drives cost more than company size. We quote after our free 2-hour readiness assessment.
Do we need SOC 2 or ISO 27001?
They are different frameworks for different audiences. SOC 2 is a CPA attestation and the most common request from buyers in the United States. If your buyers ask for something else, send us the request and we will tell you what satisfies it. We do provide both SOC 2 + ISO 27001 and actually ISO 27001 reports through our partner network.
Can Larson perform both the readiness assessment and the examination?
Yes. We assess your controls and advise on your approach. Independence standards prohibit us from designing or implementing the controls we audit, and we define that boundary during scoping.
Do we need a SOC 1 too?
Only if your service affects your clients' financial reporting. Some organizations need both.
How often do we need a SOC 2 report?
Every year, with continuous observation periods so there is no gap between reports. Buyers notice gaps.
Our prospect wants the report next month. What can we do?
Tell us the exact requirement and the deadline, and we will tell you what is achievable. A Type 1 with a committed Type 2 date often satisfies the buyer.
.png){kind=logo}
.png)
