SOC 1 vs SOC 2: What Each Report Covers and Which You Need

What is a SOC 1 report?

A SOC 1 (System and Organization Controls 1) report is a CPA’s examination of a service organization’s controls that are likely to be relevant to its customers’ internal control over financial reporting, performed under the AICPA’s AT-C section 320. The AICPA calls the customers “user entities”, and the main readers are those customers and the auditors of their financial statements.

The service organization writes its own control objectives, such as “payroll changes are authorized before processing”, and the auditor tests them. Payroll processors, claims administrators and billing or payment companies commonly need SOC 1, because their work flows straight into a customer’s financial statements.

What is a SOC 2 report?

A SOC 2 report is a CPA’s examination of a service organization’s controls relevant to security, availability, processing integrity, confidentiality or privacy, measured against the AICPA’s 2017 Trust Services Criteria. The AICPA says customers and business partners request it to understand the risk of outsourcing to that organization.

Security is mandatory in every SOC 2 report, and the other four categories are included only when they apply to your service, as Vanta’s trust services criteria guide puts it. A SaaS company storing customer data usually starts with Security alone and adds Confidentiality or Availability when a customer asks.

SOC 1 vs SOC 2: which one do you need?

You need the report the person asking can use: SOC 1 for a customer’s financial auditor, SOC 2 for a customer’s security or procurement team.

If you can’t tell from the request, ask the customer which report their auditor or security team expects. Getting the wrong one means paying for a second examination.

SOC 1 Type 2 vs SOC 2 Type 2

A SOC 1 Type 2 and a SOC 2 Type 2 both test whether controls operated effectively over a period; the difference is the subject: financial-reporting controls for SOC 1, trust services criteria for SOC 2. The AICPA’s SOC 1 guide covers both type 1 and type 2 reports, and a Type 1 checks only that controls are designed properly at a point in time. For SOC 2 alone, see how SOC 2 Type 1 and Type 2 differ.

The Type 2 observation window is usually three to twelve months, according to Drata’s and Vanta’s SOC 2 guides. That window is why a first Type 2 report takes longer and costs more than a Type 1.

What about SOC 3?

A SOC 3 is a general-use report relevant to the same five categories as a SOC 2, according to the AICPA’s SOC 2 guide, which covers both. Because it is meant for general use, a company can post a SOC 3 on its website, while a SOC 2 goes to customers who ask for it.

The AICPA’s illustrative SOC 3 contains management’s assertion, a description of the system’s boundaries and the auditor’s report, without the detailed control tests a SOC 2 includes. You get a SOC 3 alongside a SOC 2, not instead of one.

How do SOC 1 and SOC 2 differ in cost and timeline?

A SOC 2 Type 2 audit costs $12,000–$20,000 for a small or midsize company, according to Drata’s March 2026 guide; few auditors publish SOC 1 fees. Linford & Co, a CPA firm, publishes no fee figures and quotes each engagement instead.

SOC 2 usually costs more in total because it comes with compliance software and a penetration test that many customers expect. Our SOC 2 cost breakdown adds those lines up, and Vanta’s plan prices cover the most common SOC 2 software.

Is SOC 2 legally required?

SOC 2 is not legally required; it is a report customers and business partners request, according to the AICPA’s SOC 2 guide. SOC 1 is driven the same way, by customers whose financial auditors need evidence about controls at the companies they outsource to.

In practice, a contract clause or a lost enterprise deal makes it feel mandatory. Only a CPA firm can issue either report, and the AICPA says it takes action against members and refers unlicensed firms to regulators when SOC audits skip professional standards. Our how we review page explains how we checked these definitions.