"Do you have SOC 2?" is one of the most common questions in vendor security reviews. The follow-up—"Type I or Type II?"—matters because the two reports answer different questions. Confusing them leads to mismatched expectations, especially around operating effectiveness over time.
What SOC 2 is (in one sentence)
SOC 2 is an attestation framework issued under the AICPA's Trust Services Criteria. It describes how a service organization manages security, availability, processing integrity, confidentiality, and/or privacy—depending on which categories are in scope for that report.
SOC 2 Type I: point in time
A Type I report describes a vendor's controls at a specific date. It answers: "Were these controls suitably designed?" It does not, by itself, prove that those controls operated effectively across a period of months.
Type I is common for younger products that need a report quickly for enterprise sales cycles, or after major control redesigns.
SOC 2 Type II: over a period
A Type II report covers a defined period (often six or twelve months). It addresses both design and operating effectiveness: did the controls work in practice during that window?
Procurement and security teams often prefer Type II when a vendor handles sensitive data or is critical to your operations, because it reduces the designed but never run risk.
Which one should you ask for?
There is no universal rule—your risk tiering should drive the ask. Practical guidance:
- Lower risk / early screening: Type I may be enough to confirm seriousness and basic governance.
- Higher risk or regulated workloads: Prefer Type II, and read which Trust Services Categories are in scope.
- Always: confirm scope (what systems and subsidiaries are covered) and report date. A stale Type II tells you about the past, not this week's headcount changes.
Where trust centers help
Many vendors advertise SOC 2 Type II on their trust center but only ship the full report under NDA. The badge gets you oriented; the PDF is where you validate scope and exceptions. Use a directory like TrustLists to find the trust center quickly, then follow the vendor's process for the actual document.
Related artifacts
Buyers sometimes bundle SOC 2 with ISO 27001, SOC 3, penetration test letters, and privacy documentation. Those are complementary—not interchangeable. Your questionnaire should map each control family to the evidence you actually need.
This article is educational, not professional advice. Interpret SOC reports with your internal experts or advisors.