SOC 2 Type 2
A SOC 2 Type 2 is an independent audit report attesting that a company’s controls not only were suitably designed but operated effectively throughout an observation period, usually three to twelve months. Because it proves controls ran — not just that they exist — it is the report buyers weight most.
An audit report in which an independent auditor tests whether a service organization’s controls operated effectively across an observation period, typically three to twelve months, rather than only assessing their design at a point in time.
SOC 2 Type 2.
Glossary · SOC 2 Type 2What the auditor actually tests
Where a Type 1 stops at design, a Type 2 examination follows every control through an observation period — commonly three months for a first report, twelve at renewal — and checks that it ran each time it was supposed to. The auditor pulls full populations (every access request, code change, and new hire in the window), samples them, and records results control by control in the testing section, including any exceptions found along the way.
Why buyers weight it over Type 1
A Type 1 shows controls exist; a Type 2 shows someone operated them, month after month, with an independent firm checking the artifacts. That is the assurance a security reviewer wants before routing your report to their risk committee, and it is why enterprise questionnaires and RFPs so often specify “Type 2” by name. The framework itself — criteria, scoping, audit mechanics — is covered on our SOC 2 page.
Planning around the period
The calendar is the real constraint. Evidence must exist for the entire window, so a lapse in quarterly access reviews cannot be repaired after the fact — the period restarts or the miss lands in the report. Teams that treat the window as a live operating commitment, not a date on the auditor’s calendar, renew without drama; teams that rediscover it each summer do not.
Glossary
Twelve months of controls, operated for you
Agency runs the program across the whole window — controls, evidence, auditor management — so the Type 2 renews itself. 1,000+ companies served since 2021.
Platform Products
Agency AIEnd-to-end cybersecurity and compliance, across the stack you already use.GRC IntegrationsEngineer-operated GRC platform integrationAuditsuisse AIAI-powered evidence collection and analysis for IT audits.Find your auditor
Auditnex makes buying audits simpler and more transparent.
Agency implements the controls, collects the evidence, and manages your auditor relationship on top of the GRC tools you already use.
Explore AuditnexCommon GRC Questions
GRC Platform & Virtual CISO FAQ
The long-form FAQ on how managed GRC and virtual CISO coverage work together.
Read the FAQMore from Agency
See it on the home pageBuild a Security & Compliance Team Led by Your Own Virtual CISO
Forward-Deployed Engineers + AI that lower costs, increase velocity, and raise the bar — from policy to audit to remediation. U.S.-based forward-deployed engineers, supercharged by proprietary AI, operate your program end-to-end — on top of the tools you already trust.