SOC 2 report types

One date, or a window of evidence

Type I Point in time

A single date

14 Mar
nothing observed
before or after

The auditor confirms your controls are suitably designed as of one specific date. It says nothing about whether they held up the day after.

1 observation date
Type II Period of time

A window of operation

Observation period
1 Apr
30 Sep

The auditor samples evidence throughout an observation period, usually 3 to 12 months, to confirm the controls actually operated. Every sample is a chance to fail.

183 days of sampled evidence