A point-in-time assessment of your security controls design and implementation
SOC 2 Type 1 is a compliance audit that evaluates the design and implementation of your security controls at a specific point in time. Unlike Type 2, it does not test the operating effectiveness over a period.
Think of Type 1 as a snapshot: "Do you have the right controls in place?" versus Type 2 which asks: "Have those controls been working effectively for 6-12 months?"
Type 1 is often used as a stepping stone to Type 2 or as proof of security readiness for early-stage companies.
| Aspect | Type 1 | Type 2 |
|---|---|---|
| Timeline | Point-in-time (1 day) | 6-12 month period |
| Audit Focus | Control design & implementation | Operating effectiveness over time |
| Time to Complete | 4-8 weeks | 6-12 months |
| Cost | $8,000 - $20,000 | $15,000 - $50,000+ |
| Evidence Required | Policies, screenshots, configurations | Continuous logs, tickets, reports |
| Customer Acceptance | Some customers accept (early-stage proof) | Industry standard, widely accepted |
Complete our 20-question assessment to determine your current state and gaps
Implement required controls using our automation and templates
Automated evidence collection from your integrations
Auditor reviews controls, issues report
Typically 4-8 weeks from start to finish. If you already have controls in place, it can be faster. LowerPlane customers average 6 weeks.
Yes! Type 1 is often used as a stepping stone. After receiving your Type 1 report, you can begin the observation period for Type 2 (6-12 months).
It depends. Some early-stage or smaller customers accept Type 1 as proof of security. Enterprise customers typically require Type 2. Ask your prospects what they need.
Policy documents, access control screenshots, security configurations, training records, vendor assessments, and incident response procedures. LowerPlane automates 70-90% of this evidence collection.