Do we need a SOC 2 Type 1 or Type 2 report first?

Start

A customer has asked us for a SOC 2 report

A SOC 2 report is an attestation by a licensed CPA firm, and there is no pass or fail. A Type 1 report gives an opinion on the description of the system and the design of the controls as of one date. A Type 2 report adds an opinion on operating effectiveness throughout a period, with the auditor's tests and results.

• Then: Write down what each customer asked for, and by when

Step

Write down what each customer asked for, and by when

Record the type each customer named, the date the report must be in their hands and any minimum length of period they state, with the email or clause each came from. If customers ask for different things, answer for the one report you will commission and record what each asked. The pack notes that nothing in law makes a SOC 2 report mandatory, so commissioning one is your decision.

• Then: Count how long each control has run with records

Step

Count how long each control has run with records

Count from the day a control began to run and left records, not from the day it was written down. A control that is designed but not yet running counts as not running. Ask each control owner for the date of the first record and where it is kept.

• Then: Are the controls designed and running, with records?

Decision

Are the controls designed and running, with records?

Controls that are not designed or not running cannot be examined as they stand. This is the first row of the pack's report-type table (RT-1), so it decides before the customer's request or the date. If you are not sure, answer no: the pack says telling the customer where you are, in plain words, is better than a rushed report.

• Yes: Have you held a SOC 2 Type 2 report before?
• No, or not known: Get ready first, and tell the customer where you are

Outcome

Get ready first, and tell the customer where you are

Do not start either report yet. Run the readiness self-assessment, close the blocking items and come back to this question. Tell the customer plainly which stage you are at, and offer the security overview and the standard security commitments schedule in the meantime.

Decision

Have you held a SOC 2 Type 2 report before?

A second Type 2 report follows straight on from the first. The pack's table reads this row (RT-2) before it asks what the customer requested.

• Yes: Plan the next Type 2 period to start the day after the last ends
• No: Did the customer ask for a Type 1 report?

Outcome

Plan the next Type 2 period to start the day after the last ends

Start the next period on the day after the last one ends so that no day is uncovered, and agree the dates in writing with the CPA firm. Re-scope first if the service, the boundary, a major provider or a customer commitment has changed. Which report a customer accepts is for the customer to say.

Decision

Did the customer ask for a Type 1 report?

Row RT-3: a customer who asked for a Type 1 report is given one. If the customer only said 'a SOC 2 report', answer no, because the pack's default is Type 2 (SR-05) and the next rows decide. If the type is still open you may want to ask the customer which it means.

• Yes: Type 1 report, with the Type 2 period planned to follow
• No, or it did not say which: Is the report due within 3 months?

Outcome

Type 1 report, with the Type 2 period planned to follow

A Type 1 report is what the customer asked for, so it is the first step. Plan the Type 2 period to start straight after, because customers usually go on to ask for it (market practice). Describe the report by its exact type, categories, system and date, and never as certification.

Decision

Is the report due within 3 months?

A Type 2 report takes the period plus the time the CPA firm needs to issue it, and the pack allows 2 months for that as a house default, so ask your firm. A date within 3 months is too close for a Type 2 report to be issued (row RT-4). If you do not know the date, treat it as close until the customer tells you.

• Yes, or not known: Type 1 now, then a Type 2 period straight after
• No, or no date is set: Have the controls run, with records, for 3 months or more?

Outcome

Type 1 now, then a Type 2 period straight after

Take a Type 1 report as of a date inside the window, then start a Type 2 period straight after. The pack's default for that period is 6 months, or the customer's minimum if that is longer. If the controls have run for under 3 months, the Type 1 report also gives them time to run. Tell the customer plainly which report it will have and when, and confirm the dates with the CPA firm before you promise them.

Decision

Have the controls run, with records, for 3 months or more?

SR-10 says controls should have operated, with records, for at least 3 months before a first Type 2 period starts (a house default). If they have not, expect exceptions early in a short first period, or take a Type 1 report first and begin the Type 2 period when the controls have run. Controls not running at all are ready for neither report.

• Yes: Does the period fit your date and any minimum a customer states?
• No, or not known: Short first Type 2 period, or Type 1 first

Outcome

Short first Type 2 period, or Type 1 first

Under 3 months of operation, expect exceptions early in a short first period, or take a Type 1 report first, which looks at the design of the controls as of one date, and begin the Type 2 period when the controls have run. Either way, run the readiness assessment before any period starts. Tell the customer which report it will have, and when.

Decision

Does the period fit your date and any minimum a customer states?

The period is the longest of 3, 6 and 12 months that still fits once about 2 months are added for the CPA firm to issue the report. With no date set the longest is used. A customer's stated minimum overrides the period that would otherwise fit. The lengths are market practice and the 2 months a house default.

• Yes: Type 2 over the longest period that fits, at least any minimum
• No, or not known: Talk to the customer before you commit to the date

Outcome

Type 2 over the longest period that fits, at least any minimum

Type 2 is the pack's default (SR-05) and is what most customers who ask for SOC 2 mean. Run the readiness assessment first, and agree the period dates in writing with the CPA firm before the period starts. Your CPA firm and your customers decide which period they accept.

Outcome

Talk to the customer before you commit to the date

The period plus the time to issue does not fit the date. The pack's prompt is to talk to the customer about a Type 1 report before you commit. If you already hold a report, a bridge letter can cover the interval after its period. Do not shorten a period below a minimum the customer states, and do not promise a date the calendar does not support.