SOC 2 Type 1 vs Type 2: Cost, Timeline and Pentest Evidence

SOC 2 Type 1 vs Type 2 comes down to time. A Type 1 report is a CPA firm’s opinion that your controls are suitably designed and in place on a single date. A Type 2 report adds an opinion that those controls operated effectively across an observation period, usually three to twelve months. A Type 1 is faster and cheaper; a Type 2 is the report most enterprise buyers expect, because it shows months of evidence instead of one day.

The two reports also need different things from your penetration test, and a test dated in the wrong place can leave the auditor with nothing to sample. Invadel is a penetration testing company, not a CPA firm, so we do not issue SOC 2 reports. We provide the test your auditor asks for: a SOC 2 penetration test scoped to your system description, usually built around a web application penetration test from $5,200 with a free retest. The tiers are in the web application testing cost guide, and every service is on our pricing page.

SOC 2 Type 1 vs Type 2 at a glance

	SOC 2 Type 1	SOC 2 Type 2 (Type II)
The opinion covers	The system description, and whether controls are suitably designed and in place	The same, plus whether the controls operated effectively
Time covered	One date, the “as of” date	A period, usually 3 to 12 months
How the auditor tests	A walkthrough of each control on the as-of date	Samples from across the whole period, for every control
The controls section	Controls mapped to the criteria	Controls, the auditor’s tests, the results and every exception
Audit fee, small to midsize company (Drata)	$7,500 to $15,000	$12,000 to $20,000
Audit fee, startup to mid-market (BD Emerson)	$7,000 to $25,000	$12,000 to $45,000
When the pentest lands	Tested, fixed and retested before the as-of date	Inside the period, with time to retest before it closes

Fee ranges are from Drata’s SOC 2 cost guide (March 2026) and BD Emerson’s SOC 2 cost breakdown (July 2026). The two guides disagree at the top of each range, so both are shown, as in our SOC 2 cost post.

Both use the same criteria: the 2017 Trust Services Criteria (revised points of focus, 2022) and the 2018 description criteria, as applied in the AICPA’s SOC 2 guide. Security is always in scope; our SOC 2 controls list maps every criterion. Type II and Type 2 are the same report: AICPA guidance writes “type 2”, and the Roman numerals are a holdover from SAS 70.

What is a SOC 2 Type 1 (Type I) report?

A SOC 2 Type 1 answers one question: on this date, did your controls exist, and were they designed to meet the criteria? You write the system description and sign an assertion about it. The auditor walks through each control, confirms it exists on the as-of date, and judges whether its design meets its criterion (AICPA SOC 2 guide). Nothing is tested over time, so a Type 1 cannot say whether the quarterly access review happened every quarter.

It is the fastest route to a report you can hand a prospect, but because it says nothing about operation, procurement teams read it as a promise and ask when the Type 2 period ends.

What is a SOC 2 Type 2 (Type II) report?

A SOC 2 Type 2 adds the question buyers actually care about: did the controls work, every time, across the period? The auditor samples the whole window. If your access reviews run quarterly, the auditor asks for every review in the period and tests a sample of them, so a quarter with no review, or a control that lapsed for two months, shows up as an exception every customer will see.

Experienced reviewers go straight to the opinion and the exceptions. A few exceptions with a credible management response are normal; a qualified opinion is a much harder conversation.

How long is the Type 2 observation period?

There is no required length. A CPA writing for the Cloud Security Alliance notes that periods usually run three to twelve months, that many first reports cover three months to meet a specific deal, and that the better practice is to follow with annual 12-month periods. Some audit firms and contracts set minimums; confirm before you pick a window.

Which one do you need?

Your situation	Get	Why
A deal needs a report within weeks and you have none (common for startups; see startup penetration testing)	Type 1 now, and open the Type 2 period the same week	The Type 1 answers the questionnaire; the Type 2 date answers the follow-up
No deal is waiting and controls have run for a few months	Straight to a short Type 2	One audit in year one instead of two
The contract names “Type 2” or “Type II”	Type 2	A Type 1 does not satisfy a clause that names the type
You rebuilt the platform or launched a new product	Type 1 on the new system, then Type 2	Confirms the new design before months of operation are judged
Customers need assurance over controls that affect their financial statements	SOC 1, possibly alongside SOC 2	A different examination; see SOC 1 vs SOC 2

BD Emerson recommends the first row’s sequence for most first-timers, and notes that companies with mature controls and no deal pressure sometimes go straight to a Type 2. If the buyer wants a certificate instead of a report, compare ISO 27001 vs SOC 2 before you choose a type.

How long SOC 2 Type 1 and Type 2 take

The observation period is the long pole: a Type 2 cannot be issued until it ends and fieldwork is finished. A common first-year plan, with two months of readiness:

Month	Type 1 first, then Type 2	Straight to Type 2
0 to 2	Readiness, close gaps, penetration test, fixes and retest	Readiness and closing gaps
2	Type 1 as-of date; a three-month Type 2 period opens the same week	A three-month Type 2 period opens
2 to 5	Controls operate; remediation records and scans accumulate	Penetration test in the first weeks, then fixes and retest
About 3	Type 1 report in hand	No report yet
5 to 6	Type 2 fieldwork and report	Type 2 fieldwork and report

The months are illustrative; missing controls stretch readiness, and issuance depends on your audit firm.

Start scoping the penetration test six to eight weeks before you need the evidence. Our onboarding begins within 24 hours of a signed proposal, and a small application takes about a week of testing plus reporting; how long a penetration test takes covers each phase.

Is SOC 2 hard to get?

The audit is rarely the hard part. Running every control, every time, for months, with records to prove it, is.

SOC 2 Type 1 vs Type 2 cost

Counting only the CPA firm’s fee, Drata puts a small or midsize company’s Type 1 at $7,500 to $15,000 and its Type 2 at $12,000 to $20,000, with a Type 2 typically 30 to 50 percent more and large organizations paying more (Drata). BD Emerson, whose guide is the second row in the table at the top, publishes wider ranges for both report types.

The fee comparison hides a second audit: Type 1 then Type 2 means two audits in year one, which on Drata’s figures adds $7,500 to $15,000. Our SOC 2 Type 2 cost breakdown has the whole budget.

The penetration test costs the same for both, and timed well, one test can serve both, if your auditor accepts a test finished just before the period. The free retest matters most under a Type 2, where it is the evidence that the fix held.

Pentest evidence per report type

Neither report type requires a penetration test by name. In the Trust Services Criteria, testing appears only as an illustration: a CC4.1 point of focus lists it with independent certification and internal audit as ways to evaluate controls, and CC7.1’s points of focus add vulnerability scans, periodically and after significant change. Auditors and buyers still expect a recent independent test, so the real difference between the two reports is what the auditor does with it.

Evidence	Type 1: one date	Type 2: across the period
Policy requiring periodic penetration testing	Exists and is approved by the as-of date	Compared with what actually happened in the window
The penetration test report	Completed before the as-of date	Dated inside the period; for an annual control it is often the only occurrence, so it is the sample
Findings tracked to closure	Shows the process exists	Each finding traced to a ticket, with fix dates checked against your own deadlines
Retest	Strongly preferred before the as-of date	Proof the find, fix and verify loop operated, before the period closes
Vulnerability scans for CC7.1	Configured and run at least once	Every cycle your policy promises, across the window

Where pentest evidence breaks a Type 2

• The test predates the window or lands in its final weeks. A test finished before the window may not count, so confirm with your auditor; one in the final weeks leaves no time to fix and retest. SOC 2 pentest requirements covers the timing.
• Your own deadline catches you. If policy says criticals are fixed in 15 days and the fix took 40, the auditor compares the two. Write a deadline you can meet.
• The scope misses the product. Testing the marketing site does little when the system description covers the application.
• A quarterly scan is missing. If policy promises quarterly scans, one skipped quarter is an exception.
• A scan is presented as the pentest. Scanner output supports CC7.1; it is not the independent test.

The SOC 2 penetration testing evidence checklist lists every item to hand the auditor.

One test for a Type 1 and the Type 2 that follows

In the “Type 1 first” plan, test, fix and retest before the Type 1 date, and keep the remediation tickets and retest report as the first evidence your Type 2 auditor sees. That test finishes just before the Type 2 period opens, and auditors differ on whether it counts, so ask yours before you book. If yours will not, also test in the first weeks of the three-month period, as in the straight-to-Type-2 plan, then fix and retest before it closes. Run the next annual test about a year after the first, roughly three months before the first 12-month period ends, leaving time to fix and retest. If one test a year leaves gaps, penetration testing as a service runs several as one fixed-price program.

How to read a SOC 2 Type 2 a vendor sends you

When you are the buyer, check seven things:

1. Check the type and dates. Is it a Type 2, and did the period end within the past year? For the gap to today, ask for a bridge letter: the vendor writes and signs it, not the auditor, and the norm is to cover no more than about three months (Vanta).
2. Read the opinion. Unmodified is clean. Qualified means the auditor found a material problem, most often a criterion that was not met. An adverse opinion or a disclaimer is a stop sign.
3. Read the exceptions and whether management’s response is specific.
4. Match the scope to the service you buy and the categories you care about.
5. Find your homework. Carved-out subservice providers and complementary user entity controls are things the report assumes someone else, often you, is doing.
6. Check the auditor. Only a licensed CPA firm can sign a SOC 2; our guide to SOC 2 audit firms shows how to check one in the AICPA peer review file.
7. Look for tailoring. Template language, or tests that mostly ask staff instead of inspecting evidence, are the warning signs described below.

What changed in 2026, and what is proposed for 2027

In February the Journal of Accountancy reported that vendors promising SOC reports in weeks raised concerns about template reports and overreliance on inquiry. In May the AICPA told peer reviewers to assess whether a firm’s SOC 2 engagement timelines are reasonable and its engagements tailored, and, where risk looks elevated, to compare its reports for identical risk assessments, sample sizes and testing procedures. A Type 2 that is fast because the window is short is legitimate. One that is fast because nothing was tested is the target.

The AICPA’s October 2026 exposure drafts would revise the criteria, not the two report types, for engagements beginning on or after December 31, 2027; our SOC 2 controls list covers what they add.

How Invadel tests for a SOC 2 Type 1 or Type 2

We scope the test to your system description and your auditor’s dates, and map every finding to the criteria it touches. Every penetration test evidences CC4.1 (the engagement itself is an evaluation of your controls) and CC4.2 (findings, tickets and the retest):

Test	Security criteria beyond CC4.1 and CC4.2	Fixed price, from
Web application penetration test, one or two roles	CC6.1, CC6.3, CC6.7, CC7.1	$5,200
Web application test, several roles and an admin panel	CC6.1, CC6.3, CC6.7, CC7.1	$7,800
API penetration test	CC6.1, CC6.3, CC6.7, CC7.1	$4,000
External network penetration test	CC6.6, CC7.1	$4,200
Cloud penetration test	CC6.1, CC6.3, CC6.6, CC7.1	$6,800
Validated vulnerability scanning, up to 250 devices	CC7.1 between tests	$1,500 per scan

Every penetration test includes an executive summary, a technical report and a customer-shareable attestation letter, delivered as separate files that upload into Vanta, Drata and Secureframe, plus a free retest of remediated findings; scans include a free re-scan. Senior in-house testers do the work, never subcontractors. Send us your scope and the fixed price arrives in writing the same day, with no sales call. See a sample report, or compare firms with our list of SOC 2 penetration testing providers.

A SOC 2 scope often needs more than one row of that table, for example the application, its API and the external network. The penetration testing cost calculator totals them before you send the scope.

Frequently asked questions

Is SOC 2 Type 2 better than Type 1? It is stronger evidence, not a higher grade: a Type 1 covers design on one date, and a Type 2 shows the controls worked across months. Most enterprise buyers ask for a Type 2.

Can we skip the Type 1 and go straight to a Type 2? Yes, a Type 1 is optional. If no customer is waiting and your controls already run, a short first Type 2 period saves an audit fee.

How long does a SOC 2 Type 2 take? Readiness, then the observation period (usually three to twelve months), then fieldwork. With a three-month period, a first Type 2 can arrive about six months after you start.

Do we need a penetration test for a SOC 2 Type 1? SOC 2 does not require one by name, but most auditors expect it and buyers ask for it. For a Type 1, finish the test, the fixes and the retest before the as-of date.

Is there a SOC 3 Type 2? A SOC 3 has no type label. It is a general-use report that the AICPA says can be freely distributed, without the detail a SOC 2 contains, and it is usually produced alongside a SOC 2 Type 2.

How long is a SOC 2 Type 2 report valid? It has no formal expiry date, but buyers want a recent period, so companies typically run back-to-back 12-month periods and use a bridge letter until the next report arrives.

What is a SOC 2 bridge letter and who signs it? A bridge letter covers the gap between the end of the last report period and today. The vendor writes and signs it, not the auditor, so it is the vendor’s own statement, not an audit opinion, and the norm is to cover no more than about three months.

Can one penetration test cover a Type 1 and the Type 2 that follows? Sometimes. A test finished, fixed and retested just before the Type 1 date also sits just before the Type 2 period opens, and auditors differ on whether it counts for the Type 2. Ask yours before you book; if the answer is no, test again in the first weeks of the period so there is time to fix and retest before it closes.

The short version

A SOC 2 Type 1 shows your controls were designed and in place on one date; a Type 2 shows they worked across three to twelve months, and it is the report buyers want. Take a Type 1 when a deal cannot wait or the system is newly rebuilt, and open the Type 2 period the same week. Either way, the penetration test must land before the as-of date for a Type 1, or inside the period with time to retest for a Type 2. See how we scope a SOC 2 penetration test, check the web application testing prices, or scope your test for a fixed price the same day.