The 3 SOC 1 paths, compared
‘SOC 1 certification’ isn’t one thing. It’s three different journeys with different costs, timelines, and levels of assurance. Here’s how to tell which one is yours.
Most enterprise customers require a Type 2 report from a licensed CPA firm. A Type 1 is the faster, cheaper point-in-time stepping stone. Anyone facing their first examination should consider the readiness path first.
| SOC 1 Type 1 | Readiness assessment | SOC 1 Type 2 | |
|---|---|---|---|
| What it is | CPA firm opines on control design at a point in time | Gap analysis & remediation plan -- no signed report | CPA firm tests operating effectiveness over 6–12 months and issues the report |
| Who it’s for | First-time examinees; customers who accept point-in-time assurance | First-time candidates; complex or immature control environments | Most enterprise customers; user entities whose auditors rely on the report |
| Typical cost | $10K–$30K* | $5K–$25K* | $20K–$100K+* |
| Typical timeline | 4–12 weeks | 2–6 weeks | 6–12 mo observation + 4–8 wk fieldwork |
| Deliverable | SOC 1 Type 1 report | Gap report & remediation roadmap | SOC 1 Type 2 report |
| Who can issue it? | Only a licensed CPA firm | A CPA firm or readiness consultant | Only a licensed CPA firm |
* Planning estimates (September 2026), not quotes. Fees are scoped per engagement.
Path 1: SOC 1 Type 1
The point-in-time examination. A licensed CPA firm evaluates whether your controls are suitably designed to meet your control objectives as of a specific date. There is no observation period, so it moves fast -- typically 4 to 12 weeks -- and costs less. It’s the standard first step for service organizations that need a report quickly, and the design work becomes the foundation for a later Type 2. Type 1 vs Type 2 in detail →
On the Type 1 path? Get Type 1 quotes from matched CPA firms. Free · 2 minutes.
Get Type 1 quotesPath 2: Readiness assessment
A readiness (or gap) assessment is a dry run: a CPA firm reviews your control design against your objectives, tests your evidence, and hands you a remediation roadmap -- without the pass/fail pressure of a formal examination. For first-time Type 2 candidates it’s the highest-ROI spend in SOC 1: findings fixed now cost a fraction of findings fixed during a live observation period. Budget 2–6 weeks and treat the roadmap as your project plan. Note: whoever does your readiness should not compromise the independence of your examination team.
Path 3: SOC 1 Type 2
The full examination: a licensed CPA firm tests whether your controls operated effectively throughout a 6–12 month observation period, then issues your SOC 1 Type 2 report. It’s the most rigorous path -- and the only one most enterprise customers and their auditors accept. Expect the observation period plus 4–8 weeks of fieldwork and reporting. See the full timeline →
On the Type 2 path? Get competing Type 2 quotes from matched CPA firms. Free · 2 minutes.
Get Type 2 quotesPath questions
Can I choose my report type, or does someone decide for me?
Your customers -- and their auditors, who rely on your report for their own ICFR audits -- decide what they will accept. You choose how to get there: straight to a Type 2, a Type 1 first as a stepping stone, or a readiness assessment before either. Never pay Type 2 prices for a Type 1 requirement: confirm what your customers will accept in writing first.
Is a readiness assessment worth it before a Type 2?
Usually, yes -- if your controls have never been examined before. Readiness finds the gaps a Type 2 examination would flag, while fixes are cheap and don’t burn your observation period. First-time Type 2s without readiness stall far more often.
Can I do a Type 1 first and upgrade to Type 2 later?
Yes -- and many service organizations do exactly that. A Type 1 validates your control design at a point in time, which becomes the foundation for the Type 2 observation period. Just make sure your customers will accept a Type 1 in the interim.
→ Not sure? Take the 2-minute path quiz · Cost by path
Tell us your situation -- we’ll point you at the right path
One short brief. Matched CPA firms reply with path-appropriate quotes. Free, no obligation.
How it works: tell us once (4 questions, 2 min) → we match licensed auditors to your size and scope → they send scoped quotes directly. Free, no obligation.