Menu
Key facts
- Controls
- 5 Trust Services Criteria categories (Security required; Availability, Confidentiality, Processing Integrity, Privacy optional). 9 Common Criteria with 64+ points of focus.
- Recertification cycle
- Annual refresh (point-in-time report)
- Common gap categories
- Access management (CC6); Change management (CC8); Risk assessment (CC3); Vendor management (CC9)
- Related standards
What is SOC 2 Type 1?
An attestation report governed by the AICPA, using the 2017 Trust Services Criteria (revised 2022), that evaluates whether a service organization's security controls are suitably designed at a single point in time.
Is SOC 2 Type 1 a certification or an attestation?
SOC 2 Type 1 is an attestation, not a certification. The report is issued by an independent CPA firm licensed by the AICPA. There is no SOC 2 certification body, no certificate document, and no public registry to look up.
Who needs SOC 2 Type 1?
B2B SaaS companies facing early enterprise procurement scrutiny who need fast proof of security posture before a Type 2 report (which requires an observation period) is feasible.
What does SOC 2 Type 1 cost and how long does it take?
Auditor fees of $7.5K–$30K covering 1–3 months of preparation plus 2–5 weeks of fieldwork.
Type 1 is widely treated as a stepping stone. Most enterprise buyers will follow up within 12 months asking for Type 2.