SOC 2 Type 2 Report: What It Is, How to Get One, and Cost

A SOC 2 Type 2 report is an independent CPA firm's opinion on whether a company's security controls worked as designed over several months.

It is the version of SOC 2 that most enterprise customers ask for during a vendor security review.

You will also see it written as SOC 2 Type II. Both names refer to the same report.

This guide is for the company that needs to get one. It covers the requirements, what is inside the report, how the audit works, what auditors test, common first-time mistakes, and the time and cost involved. If you are new to SOC 2 itself, start with our guide to what SOC 2 is.

What Is SOC 2 Type 2?

SOC 2 Type 2 is an audit that tests whether your security controls operated effectively over a set period, usually 6 to 12 months.

That period is called the observation period, or audit window. During it, your controls run as normal and you keep evidence. Afterwards, a licensed CPA firm, called the service auditor, samples that evidence and issues a report with its opinion.

When people say a company has "SOC 2 Type 2 compliance", they mean it has a current Type 2 report with a clean opinion. The audit is run against the AICPA's Trust Services Criteria, and Security is required in every report.

SOC 2 Type 2 vs Type 1 at a Glance

A Type 1 report checks that controls were designed correctly on one date. A Type 2 report checks that those controls kept working across months.

	SOC 2 Type 1	SOC 2 Type 2
Question it answers	Were controls designed correctly on this date?	Did controls operate effectively over this period?
Audit window	One point in time	Usually 6 to 12 months
Evidence	Policies, settings, screenshots	Samples of real activity across the whole period
Time to report	Weeks to a few months	Months, because of the observation period
Who asks for it	Early deals, a first SOC 2	Most enterprise vendor reviews

If a customer asks for Type 2 while you only have a Type 1, many will accept the Type 1 plus the date your Type 2 period ends. For when a point-in-time report is enough, see our guide to the SOC 2 Type 1 report.

SOC 1 Type 2 vs SOC 2 Type 2

SOC 1 Type 2 covers controls that affect your customers' financial reporting, while SOC 2 Type 2 covers security and data protection.

Both are Type 2 reports, so both test controls over a period. The difference is the subject. Payroll and billing providers often need SOC 1. Most SaaS companies need SOC 2. Our guide to SOC 1 vs SOC 2 explains which one fits. If you are choosing between frameworks instead, see SOC 2 vs ISO 27001.

Who Needs a SOC 2 Type 2 Report?

Companies that store, process, or transmit customer data usually need a SOC 2 Type 2 report when their customers run vendor security reviews.

In practice, that means:

• SaaS companies selling to mid-market and enterprise customers
• Cloud, API, and infrastructure providers
• Managed service and IT service providers
• Fintech and health-tech companies whose customers need independent assurance

The usual trigger is a deal that stalls in security review. When a customer's questionnaire asks for a "SOC 2 Type 2 report" by name, the report is often what moves the deal forward. For early-stage teams, our guide to SOC 2 for startups covers when to start.

SOC 2 Type 2 Requirements

The core SOC 2 Type 2 requirements are a defined scope, working controls, an observation period, and an audit by a licensed CPA firm.

In more detail, you need:

• The Security criterion. Security is required in every SOC 2 report. Availability, Processing Integrity, Confidentiality, and Privacy are optional. See our guide to the Trust Services Criteria for how to choose.
• A system description. You write a description of the system in scope: the services, infrastructure, software, people, data, and procedures.
• Controls that meet the criteria. These are your policies and practices, such as access reviews, change approvals, and incident response.
• Evidence across the whole period. Records that each control ran when it should have, from the first day of the observation period to the last.
• A management assertion. A signed statement from your management that the system description is accurate and the controls were designed and operated effectively.
• An independent CPA firm. Only a licensed CPA firm can perform the audit and issue the report.

There is no fixed list of required controls. You design controls that fit your business, and the auditor tests whether they meet the criteria.

What's Inside a SOC 2 Type 2 Report

A SOC 2 Type 2 report has four main sections, plus an optional fifth, and follows a format set by the AICPA.

Section	What it contains
1. Independent service auditor's report	The auditor's opinion on your controls
2. Management's assertion	Your management's signed statement about the system and controls
3. System description	Your services, infrastructure, people, data, and controls in scope
4. Tests of controls and results	Each control, how the auditor tested it, and any exceptions found
5. Other information (optional)	Management's responses to exceptions or extra context

The AICPA publishes an illustrative SOC 2 Type 2 report that shows the format auditors follow.

The Four Possible Auditor Opinions

The auditor's opinion is the first thing your customers read, and there are four possible outcomes.

Opinion	What it means
Unqualified (also called unmodified)	A clean opinion. Controls were designed and operated effectively.
Qualified	Mostly fine, but one or more areas did not meet the criteria.
Adverse	Controls failed in a serious, widespread way.
Disclaimer	The auditor could not get enough evidence to form an opinion.

A clean opinion can still list a few exceptions. To see how auditors classify those issues, read our guide to audit findings.

How the SOC 2 Type 2 Audit Works

A SOC 2 Type 2 audit runs in four phases, and the observation period is the longest one.

Phase	What happens	Typical length
1. Readiness	Set scope, run a gap assessment, write policies, fix control gaps	Depends on how many gaps you have
2. Observation period	Your controls run and you collect evidence as you go	Usually 6 to 12 months
3. Fieldwork	The auditor samples evidence, interviews your team, and tests controls	Several weeks
4. Report	The auditor writes the report and issues an opinion	Usually one to two months after the period ends

Our step-by-step SOC 2 audit process guide walks through each phase in more detail.

Choosing Your SOC 2 Observation Period

The SOC 2 observation period is the date range your report covers, and you choose it together with your auditor.

Linford & Co., a CPA firm that performs SOC 2 audits, says reports generally cover 6, 9, or 12 months, with 12 months the most common. Some auditors accept a shorter first period, such as 3 months, so ask yours what it will accept. Two practical rules help:

• Start the clock only when your controls are in place. A control that fails on day one becomes an exception in the report.
• Pick an end date with your sales calendar in mind. Customers want recent coverage, so a period that ends shortly before your big renewals and reviews is the most useful.

What Does a SOC 2 Type 2 Audit Examine?

A SOC 2 Type 2 audit examines samples from across the whole observation period to check that each control worked every time.

Control area	What the auditor samples	Evidence they ask for
Access reviews	Each scheduled review in the period	Review records with sign-off and follow-up
Onboarding and offboarding	A sample of new hires and leavers	Tickets showing access granted and removed on time
Change management	A sample of production changes	Approvals, testing records, deployment logs
Vulnerability management	Scan results and fix records	Scan reports and fix tickets against your own deadlines
Incident response	Incidents, or a tabletop test if none occurred	Incident tickets and post-incident reviews
Vendor management	New and existing vendors	Security reviews and contracts
Security training	Employees across the period	Completion records with dates

Auditors test controls by asking questions, watching them run, inspecting records, and sometimes repeating the control themselves. In a Type 2, they do this for many samples across the period instead of one example, so collect evidence as you go rather than rebuilding it before fieldwork. A penetration test is not required for SOC 2, though a recent one can support your vulnerability management evidence; see our guide to penetration testing for SOC 2.

Scope Decisions to Make Before the Clock Starts

Your SOC 2 Type 2 scope is set before the observation period opens, and changing it midway is painful.

Which Trust Services Criteria to include. Security is required. Add the others only when your customers need assurance about them, such as Availability for an uptime-critical product.

Which systems are in scope. The report only covers the system it describes. If a customer cares about a product that is out of scope, your report will not help with that deal.

How to handle subservice organizations. If a cloud host or another provider runs part of your service, the AICPA guidance allows two methods. The carve-out method leaves their controls out of your audit and describes them separately. The inclusive method brings their controls into your audit. Schellman, a large SOC audit firm, says most of its clients choose the carve-out method, which means customers will also look at the provider's own report.

Complementary user entity controls. These are controls your customers must have in place for your controls to work, such as managing their own user accounts. Your report lists them so responsibility is clear.

Where First-Time Type 2 Audits Go Wrong

Most first-time SOC 2 Type 2 exceptions come from missed routine tasks.

The ones that show up most often:

• Missed access reviews. The review was scheduled every quarter, but one quarter got skipped.
• Late offboarding. A leaver kept access for days or weeks after their last day.
• Changes without approval. Code reached production without the documented review step.
• Training gaps. Some employees never finished security training, or finished it late.
• Evidence gaps. The control ran, but nobody kept proof, so the auditor cannot verify it.
• Vulnerabilities fixed late. Findings stayed open past the deadline in your own policy.

One exception rarely sinks a report. What matters is the pattern and how management responds. Every exception still appears in the report your customers read, so the goal is to catch these before the auditor does. A monthly internal check of the six items above is the simplest way to prepare your team.

How to Get a SOC 2 Type 2 Report: 7 Steps

You get a SOC 2 Type 2 report by preparing your controls, running them for an observation period, and passing a CPA audit.

1. Confirm the driver. Find out which customers are asking, and what they will accept.
2. Set scope. Choose the Trust Services Criteria, the systems, and how to treat subservice organizations.
3. Run a readiness assessment. Compare your current controls against the criteria and list what is missing.
4. Fix the gaps and write policies. Close the gaps and document how each control works.
5. Choose an auditor. Only a licensed CPA firm can issue a SOC 2 report. Our list of SOC 2 auditors is a good starting point.
6. Open the observation period and collect evidence. Run your controls, keep proof as you go, and review it every month.
7. Complete fieldwork and receive the report. Answer the auditor's requests, then review the draft report, including management's responses to any exceptions.

Our SOC 2 compliance checklist covers the preparation work step by step.

How Long SOC 2 Type 2 Takes and What It Costs

A first SOC 2 Type 2 usually takes about a year from a standing start.

That is an estimate, and it depends mostly on how ready your controls are. The time adds up in three parts:

• Readiness: fixing gaps before the period starts. Teams with few gaps move faster.
• Observation period: usually 6 to 12 months.
• Report: Linford & Co. says the report is generally available within a month or two after the period ends.

Renewals are faster because the controls already exist.

Cost estimates from CPA firms vary with scope and company size. The Pun Group puts a SOC 2 Type 2 audit at about $20,000 to $50,000, plus around $3,000 to $15,000 for a readiness assessment. Linford & Co. gives a wider range of $20,000 to $100,000 for Type 2 audits. Tools and your team's time come on top of the audit fee. Our full SOC 2 audit cost breakdown covers what drives the number.

How Long Is a SOC 2 Type 2 Report Valid?

A SOC 2 Type 2 report has no official expiry date, but most customers expect one covering the last 12 months.

That makes SOC 2 a yearly cycle:

• Renew on a rolling basis. Start the next observation period right after the last one ends, so there is no uncovered gap.
• Cover gaps with a bridge letter. If a customer needs assurance before your new report is ready, a bridge letter from your management can cover the gap. Our SOC 2 Type 1 guide explains how bridge letters work.
• Keep evidence flowing all year. The controls that fail in year two are usually the ones that were only done for the audit in year one.

Who Can See Your SOC 2 Type 2 Report?

SOC 2 Type 2 reports are shared privately with customers and prospects, usually under an NDA.

The report describes your systems and controls in detail, so it is meant for specific readers such as customers, prospects, and their auditors. Many companies share it through a trust center, where approved visitors can request it. While your first Type 2 is still in progress, tell customers when the period ends and when you expect the report.

If you want something you can publish openly, ask your auditor about a SOC 3 report, a short public summary based on the same audit. Companies with a SOC report from a licensed CPA firm can also use the AICPA's "SOC for Service Organizations" logo under its logo guidelines. There is no separate official "Type 2" logo.

Is SOC 2 Type 2 a Certification?

No, SOC 2 Type 2 is an attestation report, which is a CPA firm's written opinion on your controls.

There is no pass or fail badge and no certificate to renew. People often say "SOC 2 Type 2 certified" or ask about "SOC 2 Type 2 certification", whether they write Type 2 or SOC 2 Type II, and customers will understand you. In questionnaire answers, use "SOC 2 Type 2 report", which is the accurate term security teams expect.

How UprootSecurity Helps You Get and Keep a SOC 2 Type 2 Report

A SOC 2 Type 2 report proves your controls worked every day of the period. That proof is what lets customers trust you with their data.

What a Type 2 audit needs	How UprootSecurity helps
Controls ready before the observation period starts	Audit readiness for 22 frameworks, including SOC 2, with a dedicated compliance expert
Evidence that controls ran across the whole period	Continuous monitoring across 140+ integrations
A way to share your report with customers	A trust center (Growth and Enterprise plans)
Fast answers to questionnaires that ask for it	Questionnaire automation (Growth and Enterprise plans)

UprootSecurity is a compliance platform for startups and scaleups that need a SOC 2 Type 2 report to win enterprise deals. Your dedicated compliance expert sets your scope, runs the readiness assessment, and helps you fix gaps before the observation period starts. During the period, continuous monitoring checks your controls every day and keeps the evidence in one place, so a missed access review or late offboarding shows up while you can still fix it. When fieldwork begins, your evidence is already organized for the auditor. After the report is issued, the trust center and questionnaire automation help you share it and answer security reviews quickly. Next year, your SOC 2 Type 2 compliance work is already running for the renewal. See how it fits together on our SOC 2 compliance page.

Ready to get your SOC 2 Type 2 report? → Book a demo today

Frequently Asked Questions