Glossary: Business Risk, Third Parties and Compliance

SOC 2 Type 1 and Type 2

Also written: Type 1, Type I, Type 2, Type II

Type 1 checks whether controls are designed well on one date. Type 2 tests whether they actually worked over a period, often 6 to 12 months, and is the stronger evidence.