SOC 2 Type 2
A SOC 2 report testing the operating effectiveness of controls over a period, usually 3–12 months.
A Type 2 SOC 2 report evaluates whether controls operated effectively throughout a defined period, typically 3 months for a first report and 12 months thereafter. Enterprise buyers almost always want Type 2 before signing a six-figure contract. Delivered annually alongside a bridge letter between reports.