SOC 2 Type 2
A SOC 2 audit report that evaluates whether an organization's security controls are both suitably designed and operating effectively over a defined observation period, typically 3 to 12 months. Type 2 is the gold standard for third-party assurance in the US market.
A SOC 2 Type 2 report goes beyond control design to test whether controls actually operated effectively over a period of time. The auditor selects samples of transactions, reviews evidence, and tests controls to verify consistent operation throughout the observation period.
The observation period — also called the audit window or review period — typically ranges from 3 to 12 months. A first-time Type 2 audit often uses a shorter window (3 to 6 months), while mature organizations maintain a rolling 12-month period. During this window, the organization must maintain evidence that controls are operating as designed: access review records, change management logs, incident response documentation, and similar artifacts.
Type 2 reports are what enterprise buyers and security teams consider meaningful assurance. They demonstrate not just that an organization has security policies, but that those policies translate into consistent operational practice. For SaaS companies selling into the US enterprise market, a current SOC 2 Type 2 report is often a non-negotiable procurement requirement.
Related frameworks
Related terms
Audit Trail
A chronological record of system activities that provides documentary evidence of the sequence of events — including who accessed what, when, and what actions were taken. Audit trails are essential for security monitoring, incident investigation, and compliance evidence.
Control Objective
A statement describing what a specific security control is intended to achieve. Control objectives define the desired outcome — such as preventing unauthorized access or ensuring data integrity — while allowing organizations flexibility in how they implement the control to meet that objective.
SOC 2 Type 1
A SOC 2 audit report that evaluates whether an organization's security controls are suitably designed at a specific point in time. Type 1 provides a snapshot of control design without testing whether controls operate effectively over a period.
Trust Services Criteria
The five principles defined by the AICPA that form the basis for SOC 2 audits: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Organizations select which criteria to include in their SOC 2 scope based on their services and customer requirements.
Assess your compliance posture
Run a free self-assessment for ISO 27001, SOC 2, GDPR, NIS2, or Tech DD and see exactly where you stand.
Start free assessment