SOC 2 Type 1
Attestation · $10K–$150K · 4–10 weeks
- Controls
- Trust Services Criteria (security required, others optional)
- Recertification
- Point-in-time; usually followed by a Type 2
- Oversight
- AICPA-licensed CPA firm
- Common gaps
- Missing or unapproved policies, undocumented controls
- Related
- SOC 2 Type 2, ISO 27001
- Public registry
- AICPA ↗
What is SOC 2 Type 1?
SOC 2 Type 1 attests that your controls are suitably designed at a single point in time. It is faster and cheaper than Type 2 and is often used to unblock a deal while the Type 2 observation window runs.
Is SOC 2 Type 1 a certification or an attestation?
Like Type 2, it is an attestation — the CPA firm opines on the design of controls as of a specific date, not their operation over time.
Who needs SOC 2 Type 1?
Early-stage companies that need to show a credible security posture quickly, or teams bridging to a Type 2.
What does it cost and how long does it take?
Type 1 typically costs less than a Type 2 and can complete in a few weeks once controls and policies are in place.