Glossary
SOC 2 Type I vs Type II
Audit attesting that security controls are designed (I) or operating effectively (II).
Type I attests that controls were designed properly at a point in time. Type II attests that controls operated effectively over a 6–12 month observation window — much stronger. Production B2B procurement almost always wants Type II.
See also