SOC 2 Type II

What it means

A SOC 2 Type II report is the version of the SOC 2 audit that tests whether controls operated effectively across a period of time, often several months to a year. The auditor does not only read your policies. They sample real events across the window and check the controls ran each time.

The sibling, Type I, gives an opinion on whether controls are suitably designed at a single date. That is quicker and cheaper, and it proves less. A policy can look good on a Tuesday and be ignored the rest of the year, which is exactly what Type II is built to catch.

Why it matters

Larger buyers usually ask for Type II because it shows habits, not intentions. If access reviews were quarterly, the auditor looks for four of them. If new starters get a laptop with disk encryption, they check that the laptops had it. A clean report is a strong signal in procurement.

It also costs real effort. Controls must run continuously through the window, and a lapse becomes an exception noted in the report. Teams that treat it as a once-a-year scramble tend to find the gaps in the final week, when they are expensive to close.

How it shows up

The first step is picking the window and the criteria in scope. During the period you collect evidence as you go: tickets for changes, records of access reviews, scan and test results, incident records. Auditors then sample from that pool. Gaps between the end of the window and today are often covered with a short bridge letter.

Common problems are missing evidence rather than missing controls. A vulnerability management process exists but no record shows a finding was fixed. A penetration test happened but nobody checked the fixes. Keep the report, the ticket and the retest together, so a sample can be traced from finding to proof.