Title: SOC 2 Type 1 vs Type 2: a UK buyer’s guide > SOC 2 Type 1 versus Type 2 for UK buyers: which report a customer expects, what each attests, and why neither is an ISO certificate or an individual credential. Source: https://aegentra.co.uk/knowledge/soc-2-type-1-vs-type-2 Publisher: Aegentra (aegentra.co.uk), United Kingdom edition. Prices in GBP excluding VAT. Published: 2026-10-18 Updated: 2026-10-21 Licence: public web content; cite the source URL. Practical guide / United Kingdom # SOC 2 Type 1 vs Type 2: a UK buyer’s guide Clarify which report your customer expects before planning readiness work. SOC 2 is an independent attestation report, not an ISO certificate or an individual course credential. By [Harry Sidhu](https://aegentra.co.uk/about#director) — ISO 27001 Lead Implementer · Director and Principal Consultant, AegentraPublished 18 October 2026 · Updated 21 October 2026 Researched 18 October 2026. Examples are original fictional learning aids, not client results or legal advice. ## Start with the customer’s acceptance criteria Ask for the required report type, system boundary, relevant Trust Services Criteria, reporting period or date, and any deadline. Clarify whether the customer wants a report on your service rather than one from your cloud provider. Obtain acceptance criteria in writing; a readiness report or training certificate will not automatically satisfy a request for a SOC 2 examination. ## What is the difference between the two report types? A Type 1 examination addresses the system description and suitability of the design of controls as of a specified date. A Type 2 examination also addresses operating effectiveness over a specified period. Work with the independent CPA firm on the actual examination scope. Do not assume a Type 1 is always a compulsory first purchase or that any particular period will satisfy every customer. ## What evidence should readiness work organise? Identify system boundaries, commitments, responsibilities, control owners, evidence locations and gaps. For operating controls, check that records are complete for the relevant period and demonstrate actual execution. Agree supplier treatment and responsibilities with the examining firm. Software can help collect evidence, but a dashboard percentage is not the service auditor’s opinion. ## An original example: the missing quarter A fictional SaaS provider has a quarterly access-review control but retains only the most recent review. Before promising readiness for a period, it should establish which reviews actually occurred, what evidence remains and how exceptions are handled. Creating a fresh spreadsheet cannot retroactively prove that a historical review happened. Record the gap honestly and discuss its implications with the CPA firm. ## How does Aegentra’s role differ from the auditor’s? Our scoped readiness work can help organise controls, responsibilities and evidence. The independent CPA firm performs the SOC 2 examination and issues the attestation report. Consultancy fees, platform subscriptions, remediation and the CPA examination fee are separate unless a proposal expressly states otherwise. A PECB Lead SOC 2 Manager course is an individual learning route, not an examination of the organisation. ## Is SOC 1 the same as SOC 2? No. SOC 1 concerns controls relevant to user entities’ internal control over financial reporting. SOC 2 addresses controls relevant to the selected Trust Services Criteria. Identify why the customer needs assurance before choosing the engagement; neither report is an automatic replacement for the other. ## Does ISO 27001 replace SOC 2? No. An ISMS certification and a SOC 2 attestation report use different frameworks, scopes and reporting arrangements. Existing controls and evidence may support both projects, but customer acceptance must be confirmed. Ask which entity, service, criteria and period the customer expects rather than assuming a logo resolves the request. ## Check the primary sources. [AICPA: SOC suite of services](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) ## Choose the next step. [Explore SOC 2 readiness support](https://aegentra.co.uk/services/govern/soc-2) [Study the PECB Lead SOC 2 Manager bundle](https://aegentra.co.uk/academy/lead-soc-2-manager) [Compare organisational ISMS implementation](https://aegentra.co.uk/services/govern/iso-27001)