SOC 2 Type 1: the fastest route to a first report
SOC 2 Type 1 confirms that, as of a specific date, your security controls are suitably designed and implemented. It is the quickest way to satisfy a customer's 'show us your SOC 2' and to start the observation period for Type 2.
What the auditor examines in Type 1
In a Type 1 report the CPA firm gives an opinion on two things: whether management's System Description is fairly presented and whether the design of controls as of the chosen date meets the Trust Services Criteria. Operating effectiveness over time is not tested in Type 1 — that is the job of Type 2.
In practice you need approved policies, configured technical controls (MFA, encryption, logging, backups), defined processes (access, change, incident, vendor and risk management) and evidence that all of it exists on the examination date.
When to choose Type 1
- A customer or investor needs SOC 2 'as soon as possible' and cannot wait 6–12 months for a Type 2 observation period.
- You are building a control system for the first time and want a milestone.
- You need a starting point for the Type 2 window: the Type 1 date typically becomes the start of the period.
If controls have already been operating for 3+ months with evidence, going straight to Type 2 may be more efficient. We advise after a short scoping call.
Timeline and cost
A typical Type 1 project with BALTUM takes 8–16 weeks to the examination date plus 2–4 weeks for the audit and report. Cost consists of readiness (depends on the gaps and the number of TSC categories) and the group CPA firm's fixed audit fee. See How much SOC 2 costs.
What you get
- Gap analysis against the TSC with a remediation plan
- Full policy and procedure set (≈20–25 documents) in English or Ukrainian
- Technical control configuration in AWS / GCP / Azure
- System Description for the report
- Internal readiness review before the audit
- Audit support until the report is issued