Type I vs Type II
Type I evaluates the design of controls at a specific point in time. Type II evaluates the operating effectiveness of controls over an observation window (3 months typical for a first Type II, 12 months thereafter).
FRAMEWORKS
SOC 2
Service Organization Control 2
THE DELIVERABLE
SOC 2 produces a report signed by a licensed CPA firm.
WHO NEEDS THIS?
Who needs this?
B2B software companies selling into the US market. Enterprise procurement overwhelmingly defaults to requesting a SOC 2 Type II.
OUR ENGAGEMENT
Our Engagement
We perform the independent audit and issue the report or certificate.
We explicitly do not design controls, write policies, or provide remediation consulting.
BEFORE STARTING
You must have policies written, systems configured, and controls operational. If you are not there yet, you need a readiness consultant.
KEY DETAILS
Key Details
Trust Services Criteria
Security is always required. Availability, Processing Integrity, Confidentiality, and Privacy can be added based on your business model and customer commitments.
Market Reality
Buyers overwhelmingly want Type II. Type I is generally used as a stopgap measure for an urgent deadline while the Type II observation window runs.
TIMELINE / PRICE
Timeline
4-8 weeks depending on Type I vs Type II and organization complexity.
Price
Starts at $9,000 for Type I, $12,000 for Type II.
REQUEST A FIXED-FEE QUOTE
SOC / 02
Get an exact
figure.
Fill out a short questionnaire with your company size and framework needs. We return a binding fixed-fee proposal within one business day.
Request a quote ↗