After the Delve scandal broke in March 2026 — 493 fake SOC 2 reports, Y Combinator exit, the whole thing — enterprise buyers started scrutinizing SOC 2 reports differently. Security reviewers who used to accept a PDF without reading it are now asking pointed questions: What's the audit period? Who's the CPA firm? Is this Type 1 or Type 2?
That last question trips up a lot of startups. The answer matters more than most founders realize. Type 1 and Type 2 aren't just different levels of the same thing — they answer fundamentally different questions. And the wrong one at the wrong time can cost you a deal or $30,000 in unnecessary audit fees.
Here's what actually differentiates them, which one enterprise buyers require, and how to sequence your compliance path so you're ready when it counts.
The core difference: a snapshot vs. a track record
SOC 2 Type 1 answers one question: Are your security controls appropriately designed as of today? An auditor examines your policies, configurations, and control implementations at a single point in time and issues a report saying "yes, these look right" or noting where they don't.
SOC 2 Type 2 answers a harder question: Did those controls actually operate consistently over the past 6–12 months? The auditor examines evidence collected throughout an observation period — access logs, change management records, training completions, incident reports — and attests that controls weren't just designed correctly but were working correctly, consistently, over time.
Point-in-Time Design Assessment
Evaluates whether controls are suitably designed on a specific date.
Timeline: 4–8 weeks after your controls are in place.
Cost: $10,000–$30,000 in audit fees.
Observation period: None. Audit day only.
Enterprise acceptance: Declining. Most procurement teams treat it as a bridge, not a destination.
Operating Effectiveness Over Time
Evaluates whether controls operated effectively over a defined period, typically 6–12 months.
Timeline: 9–18 months total from implementation through final report.
Cost: $20,000–$50,000 in audit fees plus platform costs.
Observation period: Minimum 6 months. 12 months preferred for initial reports.
Enterprise acceptance: The standard. Required by most enterprise procurement teams.
The analogy that holds up: Type 1 is a driver's license photo taken the day you passed your test. Type 2 is your three-year driving record. An insurance company cares about the record, not the photo.
What the audit actually examines in each type
Both report types evaluate controls against the AICPA Trust Services Criteria — Security is mandatory, and organizations can optionally include Availability, Processing Integrity, Confidentiality, and Privacy. The difference is in the evidence.
For a Type 1, the auditor examines:
- Policy documents — do they exist, are they approved, do they cover required areas?
- System configurations — is MFA enforced? Are access controls set correctly?
- Control documentation — can you show the auditor that the process you described is actually in place?
For a Type 2, the auditor samples evidence across the observation period:
- Access logs showing user provisioning and deprovisioning events throughout the period
- Quarterly or semi-annual access review records — and evidence they happened on schedule
- Change management tickets for every production deployment during the period
- Security training completion records for all employees, including new hires
- Incident logs, even minor ones — zero incidents over 12 months is a red flag, not a clean record
- Vendor review evidence — proof you checked that your critical vendors stayed compliant
The Type 2 evidence burden is substantially higher. Controls that looked fine on Type 1 audit day can generate exceptions in Type 2 if they weren't consistently applied. One missed quarterly access review, one employee whose access wasn't revoked within your policy's 24-hour window, one production deployment that bypassed your change management process — those become audit findings.
Following the Delve scandal, auditors are increasingly scrutinizing evidence authenticity. Expect more requests for system-generated logs with timestamps rather than screenshots, and more direct verification with your cloud infrastructure and identity providers. Prepare to give your auditor read-only access to your SIEM, identity provider, and cloud configuration — not just exported PDFs.
What enterprise buyers actually require
Enterprise security questionnaires have changed. Most organizations with over 500 employees now explicitly request SOC 2 Type 2 in vendor onboarding forms. Some accept Type 1 as a temporary measure — you get provisional approval while your Type 2 observation period accumulates — but that acceptance is narrowing.
The practical reality: if you're targeting mid-market and enterprise SaaS deals, a Type 1 report will get you through initial security review at some companies, but it won't get you through vendor approval at others. You'll lose deals you don't know you're losing — the prospect's procurement team flags "no Type 2" and the deal stalls, with no explanation given to your AE.
Type 2 closes that gap. It's not just a compliance checkbox — it's the document that ends the "we need to complete a vendor security review" hold on deals.
Check your policy gaps before starting the audit clock
PolicyAudit scans your security policies, incident response procedures, and access control documentation against SOC 2 Trust Services Criteria — before you pay an auditor to find the same problems. Free for up to 3 documents.
Scan your SOC 2 policies for free →The cost and timeline breakdown
| Item | Type 1 | Type 2 |
|---|---|---|
| Audit fees (CPA firm) | $10,000–$30,000 | $20,000–$50,000 |
| Compliance automation platform | Optional ($10K–$30K/yr) | Recommended ($10K–$30K/yr) |
| Readiness prep / consulting | $5,000–$20,000 if starting from scratch | $5,000–$20,000 if starting from scratch |
| Time from controls ready to report | 4–8 weeks | 7–14 months |
| Observation period required | None | 6–12 months minimum |
| Typical total first-year spend | $20,000–$60,000 | $40,000–$100,000 |
One thing that catches founders off guard: you don't save money by doing Type 1 first and then Type 2 later. You spend on both audits separately. The Type 1 cost doesn't apply toward the Type 2 — it's two separate engagements with two separate fees. If you do Type 1 first, budget for both.
When to get Type 1 first
There's exactly one good reason to get Type 1 before Type 2: you have a deal on the table that requires SOC 2 now, and you can't wait 12 months for a Type 2 observation period to complete.
In that scenario, Type 1 is your bridge. You get it done in 4–8 weeks, satisfy the prospect's immediate security review requirement with a legitimate report, and start your Type 2 observation period simultaneously. By the time the deal closes and onboarding begins, you're 2–3 months into your Type 2 observation window.
Outside of that scenario, Type 1 first is a money sink. You're paying $10K–$30K for a report that enterprise buyers are increasingly skeptical of, then paying again for Type 2 a year later. Better to invest that money directly in the Type 2 path.
If you sell to federal agencies or DoD contractors, SOC 2 Type 2 alone is rarely sufficient. Federal buyers typically require FedRAMP, CMMC, or NIST 800-171 compliance depending on the contract type. SOC 2 can supplement those frameworks but doesn't replace them. The CMMC Level 2 observation period requirements also differ from commercial SOC 2 standards.
The observation period math most startups get wrong
The Type 2 observation period starts when your controls are implemented and operating — not when you engage an auditor, not when you sign a compliance platform contract, not when you finish writing your policies. The clock starts when you're actually running the controls.
That means the sequence matters:
Implement controls and policies (4–12 weeks)
Write your information security policy, access control policy, change management procedures, incident response plan, and vendor management policy. Get them approved. Implement MFA, configure least-privilege access, set up your change management workflow, establish a vendor inventory. This is the pre-observation work.
Rushing this phase is where most Type 2 exceptions originate. Controls implemented sloppily generate findings immediately.
Start the observation clock (month 0)
Once controls are running correctly, your observation period begins. Most organizations target a 6-month period for first-time reports — it's the minimum, and it reduces how long you have to maintain everything before getting the report in hand. Your audit firm will agree on the period start date with you.
Run controls consistently throughout (months 1–6+)
Every control must operate throughout the period. Quarterly access reviews need to happen on schedule. Change management needs to be followed for every deployment. New hires need training within your defined onboarding window. Incidents, even minor ones, need to be logged. Evidence must accumulate.
The most common Type 2 finding: a control that worked correctly for five months, then missed one cycle near the end of the observation period. That single exception appears in the report.
Fieldwork and report (weeks 1–8 post-period)
After the observation period ends, the auditor conducts fieldwork — requesting evidence samples, testing controls, interviewing personnel. The draft report typically follows 4–8 weeks after fieldwork concludes, with a final report 2–4 weeks after that.
From observation period start to final report: 8–14 months depending on period length and auditor capacity.
The practical implication: if you want a SOC 2 Type 2 report in time for Q4 enterprise deals, you need to have controls running and the observation period started by at least Q1 of that year, ideally earlier. Most startups start this process too late and spend a year watching deals stall.
What you need in place before the observation period starts
This is where PolicyAudit is useful. Before you start the Type 2 clock, you want to know that your policy documentation actually satisfies SOC 2 requirements — not just that you have documents, but that they cover the right control areas at the right level of specificity. Gaps discovered during fieldwork can generate findings against controls you thought were covered.
The minimum policy inventory auditors check:
- Information Security Policy
- Access Control Policy (user provisioning, access reviews, offboarding timelines)
- Change Management Policy
- Incident Response Plan
- Vendor Management Policy
- Risk Assessment Policy
- Data Classification Policy
- Business Continuity and Disaster Recovery Plan
- Acceptable Use Policy
Each policy needs formal management approval, version control, and a defined review cadence. Evidence of approval and distribution — not just the document itself — is part of what auditors examine.
PolicyAudit runs your drafts through SOC 2 Trust Services Criteria and flags sections that auditors are likely to question. It's significantly cheaper to fix a vague incident response procedure before the observation period starts than to generate a finding during fieldwork.
How compliance automation platforms fit into this
Platforms like Drata and Vanta connect to your cloud infrastructure, identity providers, and code repositories to collect SOC 2 evidence automatically throughout the observation period. That's genuinely valuable — it removes the manual evidence scramble and gives your auditor continuous, system-generated logs instead of exported screenshots.
What they don't do: write your policies for you, verify that your policy documents satisfy SOC 2 requirements before the audit, or fix control gaps discovered mid-observation-period. The platform collects evidence; your team ensures the underlying controls are correctly implemented and that your written policies accurately describe what those controls actually do.
The combination that works: PolicyAudit to validate your policy documentation before the observation period starts, Drata or Vanta to automate evidence collection during it, and a reputable CPA firm for the actual attestation. Each tool does a different job.
Frequently asked questions
Don't start the Type 2 clock until your policies are ready
Policy gaps discovered during SOC 2 fieldwork become audit findings — and findings in your first Type 2 report follow you into every subsequent renewal. Check your information security policies, access control procedures, and incident response plan against SOC 2 requirements before the observation period starts. PolicyAudit makes this free for up to 3 documents.
Check your SOC 2 policy readiness →