A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →A SOC 2 Type I report attests that your security controls are designed correctly at a single point in time. A SOC 2 Type II report attests that those same controls operated effectively over a period, usually three to twelve months. Type II is harder to earn and is what most enterprise buyers ultimately require.
Type I is a snapshot. It answers "are the right controls in place today?" and is faster to obtain, which makes it useful for unblocking a deal that is stalling on the security review.
Type II is a track record. The auditor samples evidence across the observation window to confirm controls ran consistently, not just on audit day. The common path is to earn Type I first, then run a Type II observation period immediately after.
traztech delivers SOC 2 Type I and Type II delivery for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
The distinction becomes practical the moment somebody asks for a date. A Type I can be issued as soon as controls are designed and in place, so it is achievable in the near term. A Type II attests that those controls operated across a period, so the period has to elapse before the report can exist.
The mistake we see is treating Type I as a lesser version of the same document. It is better understood as the first half of the same programme: if every control is designed to produce evidence, the observation window becomes a waiting period rather than a second project.
Frequently yes, as an interim step, particularly if you can state when the Type II window closes. Some enterprise procurement teams will only accept a Type II, which is worth establishing before you scope the work.
Three months is common for a first report and twelve months for a mature cycle. Shorter windows are cheaper and faster but some buyers discount them, so the window length is a commercial decision as much as a technical one.
Everyone on our list also gets The Compliance Brief, one email every Tuesday on what changed in security and compliance that week. Read the latest issue.