Type 1: point-in-time
A report on the system description and control design at a specific date. A useful first step, but it does not demonstrate operating effectiveness over subsequent months.
Type 2: operating over time
Also evaluates operating effectiveness during a stated review period. Evidence needs to be generated and retained continuously, not assembled at the end.
Trust Services Criteria
Security is central; availability, processing integrity, confidentiality or privacy are included as scoped. A vendor questionnaire is not the same as independent attestation.
Practical preparation
Define system scope, owners, access, logs, incidents, changes, backups, third parties and evidence periods. Remediate gaps before the examination window.
At a glance
| Dimension | Type 1 | Type 2 |
|---|---|---|
| Period | Single date | Stated period |
| Assurance focus | Control design | Design + operation |
| Preparation | Scope and controls | Continuous evidence capture |
How SFERE can support
SFERE can prepare the evidence matrix; the SOC 2 report must be issued by a qualified independent practitioner.
Official laws, standards & publisher resources
This is an editorial explanation. Verify consolidated laws, applicable standards and interpretations for your activity, country and date. Full standards may require a licence.