By Marçal Santos, CISO and founder of SecureLeap. CISM and CDPSE (ISACA). Previously security roles at Aircall, Citibank and Talkdesk. 20+ years in cybersecurity and more than 30 SOC 2 audits led over his career.
SOC 1 and SOC 2 answer different questions for different readers. A SOC 1 report tells your customer's financial statement auditor whether it can rely on your controls over the numbers your service feeds into the customer's books. A SOC 2 report tells your customer's security and procurement team whether your controls protect its data and keep your service running. The number is not a level: a SOC 2 is not an upgrade of a SOC 1, and neither one replaces the other.
For most startups the answer is SOC 2. You need a SOC 1 only when your product calculates, records or moves amounts that end up in a customer's financial statements, as payroll, payments, billing and claims services do. If your service does both, you need both reports, from two separate examinations.
SecureLeap prepares startups for SOC 2 and does not do SOC 1 work. For SOC 1, this guide relies on the AICPA, PCAOB and IAASB texts listed under Sources, checked in October 2026, not on our own engagements.
Key takeaways
- Different readers. SOC 1 is written for your customers and their financial statement auditors. SOC 2 is read by your customers' security, procurement and vendor-risk teams.
- Different yardsticks. A SOC 1 tests control objectives that your management writes for your service. A SOC 2 tests the AICPA Trust Services Criteria, with Security always in scope.
- A SOC 2 does not answer a SOC 1 request. If a customer's auditor asks for a SOC 1, sending your SOC 2 starts a second conversation instead of ending the first.
- Both come as Type 1 or Type 2. A SOC 1 Type 2 should ordinarily cover at least six months, set around your customers' fiscal years. A SOC 2 Type 2 window runs 3 to 12 months.
- Neither is public. The public version of a SOC 2 is a SOC 3; a SOC 1 has none.
- Outside the US, SOC 1 has a twin: ISAE 3402, the international standard for the same kind of report.
SOC 1 vs SOC 2 at a glance
Both are System and Organization Controls (SOC) reports, issued by an independent CPA firm under the AICPA's attestation standards (SSAE No. 18, codified as the AT-C sections). The difference is the question each one answers and who reads the answer.
What is a SOC 1 report?
A SOC 1 report covers the controls at a service organization that are likely to be relevant to its customers' internal control over financial reporting. The AICPA describes SOC 1 reports as intended for the entities that use the service and the CPAs who audit those entities' financial statements.
Why the request reaches you. When your customer's auditor plans its financial statement audit, it has to consider the services the customer outsources. For US public companies the rule is PCAOB AS 2601, Consideration of an Entity's Use of a Service Organization, which is also why SOX-driven customers ask for SOC 1 reports (SOX vs SOC). A SOC 1 Type 2 report lets that auditor rely on your controls instead of testing them itself.
What is in scope. Your management writes the control objectives for the service, and the auditor tests the controls behind each one. A payroll provider's objectives might say that pay runs are authorized, calculated accurately and paid on time, and that changes to the payroll application are approved and tested. The IT general controls behind them (access, change management, operations) are tested only as far as they support those objectives. A SOC 1 is not a review of your overall security.
"For a SOC 1, there are no set criteria that have to be met, but rather control objectives have to be defined that address the services being provided," writes Nicole Hemmer, CISSP and CISA, co-founder and partner at the CPA firm Linford & Co.
Who needs a SOC 1
- Payroll and benefits administration
- Payment processing and billing
- Claims processing and loan servicing
- Fund administration and investment record-keeping
- Software that calculates or records amounts customers post to their books, such as revenue recognition or invoicing
A finance-themed product is not enough on its own. Software that only shows customers their own financial data, without calculating or moving the amounts, usually needs a SOC 2 and no SOC 1. The test is whether your output ends up in their financial statements, not whether your buyers work in finance.
Hosting can count too. "A data center may pursue a SOC 1 report if its services directly impact clients' financial reporting or if it hosts and manages systems that process financial transactions," writes Chad Goubeaux, a manager at the CPA firm Schellman who leads its SOC methodology group.
Old names you will still hear
SOC 1 reports used to be called SAS 70 reports (the AICPA still notes the old name), then SSAE 16 reports. SSAE No. 18 superseded SSAE 16 for reports dated on or after May 1, 2017. A request for an SSAE 16 report is a request for a SOC 1. A request for an SSAE 18 report could mean either, because SOC 2 is performed under SSAE 18 too.
What is a SOC 2 report?
A SOC 2 report covers controls relevant to the security, availability, processing integrity, confidentiality or privacy of a service and the information it handles. The controls are tested against the AICPA's 2017 Trust Services Criteria, with points of focus revised in 2022. Security, also called the common criteria, is in every SOC 2. The other four categories are added when they match what you promise customers.
About 90% of the SOC 2 engagements we run are scoped to Security only; customers' contracts are what bring in Availability or Confidentiality. Our Trust Services Criteria guide explains how to decide.
A SOC 2 is an attestation, not a certification: an independent CPA firm gives an opinion on your controls, and buyers read the report rather than check a certificate. The SOC 2 compliance guide covers the whole process.
SOC 1 vs SOC 2: which report does your business need?
Start from what your service does for the customer. Two questions settle most cases:
- Does your output end up in the customer's financial statements? Then a SOC 1 is in play.
- Do you store, process or transmit the customer's data? Then a SOC 2 is in play.
Most startups answer no to the first and yes to the second. The table covers the common cases:
For healthcare, a SOC 2 shows how you protect patient data, but it does not establish HIPAA compliance on its own; see SOC 2 and HIPAA.
A customer asked for a SOC report: which one do they mean?
Requests often arrive without a number. "Many of our clients and prospects get asked for a 'SOC report' from their clients or customers without any further clarification," notes Nicole Hemmer of Linford & Co. Who sent the request and the words they use usually tell you which report they mean:
Before you ask any CPA firm for a quote, get three answers in writing from the requester:
- Who will read it: your finance team and auditors, or your security and vendor-risk team?
- Which type and period: Type 1 or Type 2, and which period or fiscal year-end must it cover?
- For a SOC 2: which categories beyond Security?
Every firm you then approach prices the same scope.
Can a SOC 2 replace a SOC 1?
No. The two reports carry different opinions on different criteria. A SOC 2 says nothing about whether your controls meet objectives tied to your customer's financial reporting, which is exactly what the customer's auditor needs. The SOC 1 is the report built for that auditor: in the AICPA's words, SOC 1 reports "are specifically intended to meet the needs of entities that use service organizations (user entities) and the CPAs that audit the user entities' financial statements (user auditors)". The AICPA did issue a separate interpretation on whether and how a financial statement auditor may use a SOC 2 (Interpretation No. 1 of AU-C section 402, 2022), but that is the exception, not a substitute you can plan on.
The reverse holds too. A SOC 1 does not answer a security questionnaire, because security controls appear in it only where they affect financial reporting.
If you need both
Two examinations, two reports, two opinions: there is no combined SOC 1 and SOC 2 report. Many controls overlap, such as access reviews, change management and backups, so one CPA firm can test them once and use the evidence in both, which cuts fieldwork. Ask the firm to price each report separately, and to align the periods where your customers' year-ends allow it.
Type 1 and Type 2 apply to both
Type 1 and Type 2 are not a SOC 2 feature: a SOC 1 comes in both types too, with the same meaning. A Type 1 gives the auditor's opinion on the design of controls on one date. A Type 2 adds whether they operated effectively throughout a period. With SOC 3, that makes five reports a customer can mean:
Why a SOC 1 period has a floor. PCAOB AS 2601 says a report on operating effectiveness "should ordinarily cover a minimum reporting period of six months" to be useful to user auditors. ISAE 3402 says the same for the international version: "To be useful to user auditors, a type 2 report ordinarily covers a minimum period of six months" (paragraph A30).
The period also has to overlap the fiscal year the customer's auditor is testing, because months outside it have no opinion behind them. Large providers solve this with rolling periods: AWS publishes SOC 1 reports quarterly, each covering the previous 12 months, so customers with different year-ends can each find one that fits.
A SOC 2 has no customer year-end to match, so you set its window around when buyers need a current report. Schellman puts the range at "typically anywhere from 3 months (often times for first-time reports) to 12 months (typical recurring cadence)". Our SOC 2 Type 1 vs Type 2 comparison covers that choice.
SOC 1 and ISAE 3402: what European customers ask for
ISAE 3402, Assurance Reports on Controls at a Service Organization, is the IAASB standard for the same kind of report as a SOC 1: controls at a service organization that are likely to be relevant to customers' internal control as it relates to financial reporting. If your customer's auditor works under international rather than US standards, the request may name ISAE 3402 instead of SOC 1.
The two are not the same document. A SOC 1 is issued by a US CPA firm under AT-C section 320; an ISAE 3402 report is issued under the international standard. One engagement can meet both: AWS runs its SOC 1 audit in accordance with ISAE 3402 as well, and points customers who need an ISAE 3402 report to its SOC 1 Type II. Ask the requester which standard their auditor needs before you scope, and check whether a SOC 1 is acceptable.
There is no ISAE counterpart for SOC 2. European buyers asking about security usually want a SOC 2 or ISO 27001 certification; our guide on SOC 2 for European startups covers when each one fits. Bridge letters work the same way for SOC 1 and ISAE 3402 as for SOC 2 (bridge letter guide).
SOC 1 vs SOC 2 cost and timeline
Both are priced on scope, not on the report name: how many systems, locations, control objectives or criteria are in scope, and whether you need a Type 1 or a Type 2.
SOC 2. For a SaaS company under 50 employees with one to three criteria in scope, the audit fee runs $5,000 to $12,000 for a Type 1 and $8,000 to $18,000 for a Type 2. With readiness work, a penetration test and tooling, a first year usually lands at $20,000 to $35,000 all-in; the SOC 2 cost guide breaks it down with real invoices, and how long SOC 2 takes breaks down the calendar.
SOC 1. We don't publish a SOC 1 range. SecureLeap does not do SOC 1 work, and we have no quotes of our own to stand behind. The fee depends mostly on the number of control objectives and processes in scope. For the calendar, work back from your customers' year-ends: a Type 2 period of at least six months that overlaps them, then fieldwork and reporting after the period closes. If you need both reports, ask one CPA firm to quote them separately.
What to check in a SOC report you receive
The same reading order works for a SOC 1 or a SOC 2, whether you're reviewing a vendor's report or preparing to hand over your own:
If the period ended months ago, ask the provider for a bridge letter covering the gap. To see how these sections look in a real report, read what a SOC 2 Type 2 report contains.
SOC 3 and the rest of the SOC family
A SOC 3 is the general-use version of a SOC 2: it covers the same criteria with less detail, so the AICPA treats it as a report that can be freely distributed. Companies post it on their trust page or send it before an NDA is signed, and it needs the SOC 2 work underneath it (SOC 2 vs SOC 3). A SOC 1 has no public version.
The AICPA's suite also includes SOC for Cybersecurity, a report on an entity-wide cybersecurity risk management program, and SOC for Supply Chain. Neither is what a customer means by a SOC report, and neither replaces a SOC 2 in a vendor review.
Common mistakes
- Sending a SOC 2 to a customer's financial auditor. It answers a different question. Expect a request for a SOC 1 or for extra testing.
- Buying a SOC 1 because your customers are finance teams. Selling to CFOs is not the test; your output ending up in their financial statements is.
- Treating SOC 2 as the advanced SOC 1. The numbers are not levels. Neither report is better; each one fits one reader.
- Setting a SOC 1 period without asking for the customer's year-end. Months outside its fiscal year carry no opinion its auditor can use.
- Calling either one a certification. Both are attestation reports with an auditor's opinion. SOC 2 certification is common shorthand, but contracts should name the report and the type.
- Assuming your report covers your cloud provider. If your SOC 2 uses the carve-out method for AWS, Google Cloud or Azure, that provider's controls are excluded, and customers read the provider's own report for them.
How SecureLeap helps
SecureLeap takes startups from no security program to a SOC 2 report: gap assessment, policies, remediation guidance and audit facilitation with an independent CPA firm, typically 3 to 4 months to a first Type 1 (SOC 2 consulting). We also help you read the requests that land in your inbox, so you know whether a customer is asking for a SOC 2, a SOC 1 or something else before you spend money on an audit.
We don't do SOC 1 work. If your service needs one, choose an audit firm that performs both reports; our guide to the best SOC 2 auditors lists what to ask them.
Book a free call to check which report your pipeline actually needs.
FAQ: SOC 1 vs SOC 2
Is SOC 2 better than SOC 1?
No, they answer different questions for different readers. The right report is the one the requester can use: SOC 1 for the financial statement auditor of a customer, SOC 2 for its security and vendor-risk team.
Can a SOC 2 report replace a SOC 1?
No. A SOC 2 does not test controls against objectives tied to customer financial reporting, so an auditor who needs SOC 1 assurance will not get it from a SOC 2.
Do I need both SOC 1 and SOC 2?
Only if your service both feeds customer financial statements and handles customer data, as payroll, payment and billing platforms often do. Most startups need only SOC 2.
Is SOC 1 the same as SSAE 18?
No, SSAE 18 is the AICPA attestation standard that both reports are performed under. SOC 1 is the report on financial reporting controls, issued under AT-C section 320.
Are SOC 1 and SOC 2 reports public?
No, both are restricted to the customers and parties they are written for and are usually shared under an NDA. SOC 3 is the public version of a SOC 2, and SOC 1 has no public version.
Is SOC 2 a certification?
No, it is an attestation report in which an independent CPA firm gives an opinion on your controls. Buyers read the report, its period and its exceptions instead of checking a certificate.
How long does each report take?
A first SOC 2 Type 1 typically takes 3 to 4 months from kickoff, and a Type 2 adds a 3 to 12 month observation window. A SOC 1 Type 2 period should ordinarily cover at least six months, set around the fiscal years of your customers.
Sources
- AICPA and CIMA, SOC 1: SOC for Service Organizations: ICFR
- AICPA and CIMA, SOC 3: Trust Services Criteria for General Use Report
- AICPA and CIMA, 2017 Trust Services Criteria (With Revised Points of Focus, 2022)
- AICPA and CIMA, Interpretation No. 1 of AU-C Section 402, December 2022
- AICPA and CIMA, Employee benefit plans: SOC 1 reports and service organizations
- PCAOB, AS 2601, Consideration of an Entity's Use of a Service Organization, paragraphs .01 and .53
- AICPA and CIMA, Statement on Standards for Attestation Engagements No. 18
- IAASB, ISAE 3402, Assurance Reports on Controls at a Service Organization, paragraph A30
- Nicole Hemmer, Linford & Co, SOC 1 vs. SOC 2: How They Are Different and Which Report You Need
- Chad Goubeaux, Schellman, Do Data Centers Need SOC 1 or SOC 2?
- Schellman, SOC Report Type 1 vs Type 2
- Amazon Web Services, SOC FAQs
All checked in October 2026.
%20(49)%20(1).avif)
%20(33)%20(2).avif)
%20(17)%20(1).avif)