7 minute read | Updated October 29, 2026
When an IT provider says it has a SOC 2 report, the next question is simple: which type?
A SOC 2 Type 1 report evaluates control design at a specific date. A Type 2 report also evaluates whether those controls operated effectively over a defined period. For a government contractor giving a provider administrative access to its systems, that additional evidence matters.
But the report type is only the starting point. You also need to know which services were examined, what the auditor found and which responsibilities remain with your organization.
Here is how to compare the reports and use them when evaluating an IT partner.
What SOC 2 tells you about an IT provider
SOC 2 is an independent examination performed by a CPA firm using standards established by the American Institute of Certified Public Accountants, or AICPA. It addresses controls relevant to the AICPA’s Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy.
Security is included in every SOC 2 examination. The other categories depend on the examination’s scope. A report does not automatically cover all five.
Three distinctions help you interpret what a provider is offering:
-
It is an examination report. Ask for the report rather than relying on a badge or a claim of “SOC 2 certification.”
-
It covers a defined system. The services you plan to buy need to fall within the system described in the report.
-
It has a restricted audience. Providers typically share SOC 2 reports with eligible customers and prospective customers under a nondisclosure agreement.
The report provides evidence for a vendor review. It does not guarantee that a provider will never experience a security incident.
SOC 2 Type 1 vs. Type 2: snapshot and track record
Both report types address the description of the provider’s system and the suitability of its control design. Type 2 adds testing of operating effectiveness over time.
| What to compare | SOC 2 Type 1 | SOC 2 Type 2 |
|---|---|---|
| Time covered | A specified date | A specified period |
| Control design | Evaluated | Evaluated |
| Operating effectiveness over time | Not evaluated | Evaluated |
| What you learn | Whether controls were suitably designed at that date | Whether controls were suitably designed and operated effectively during the period |
| What to examine closely | Scope, date and auditor’s opinion | Scope, period, auditor’s opinion, tests and results |
Consider employee offboarding. Suppose a provider’s policy requires removing access within 24 hours of an employee’s departure.
A Type 1 examination evaluates the design of that control within the implemented system at the specified date. A Type 2 examination also tests evidence of how the control operated during the reporting period. That testing may use a sample of departures rather than examine every employee who left.
The 24-hour deadline in this example is the provider’s policy, not a universal SOC 2 requirement.
Type 1 can be a useful starting point. Type 2 generally provides stronger evidence of operating effectiveness for an ongoing IT relationship. However, a Type 2 report covering an unrelated service will not answer your questions about the systems the provider will manage for you.
Does SOC 2 satisfy CMMC or DFARS requirements?
No. A provider’s SOC 2 report does not establish your organization’s compliance with the Cybersecurity Maturity Model Certification (CMMC) program, NIST SP 800-171 or DFARS.
SOC 2 can support vendor due diligence. Federal cybersecurity obligations depend on your contracts, the information involved and the systems used to handle it.
For defense contractors, these distinctions matter:
-
DFARS 252.204-7012: Where this clause applies through your contract or subcontract, it establishes safeguarding and incident-reporting obligations. These include NIST SP 800-171 requirements for applicable covered contractor information systems and reporting qualifying cyber incidents within 72 hours of discovery.
-
CMMC: Level 1 assesses basic safeguarding requirements under FAR 52.204-21. Level 2 assesses the requirements in NIST SP 800-171 Revision 2. The required assessment depends on the applicable contract requirements.
-
External cloud services: When the DFARS clause applies and an external cloud provider stores, processes or transmits covered defense information, the contractor must ensure that the provider meets the required FedRAMP Moderate-equivalent security requirements and the clause’s incident-response and investigation-support obligations. SOC 2 alone does not establish that.
The current DFARS clause explains these obligations in detail.
CMMC update (as of October 2026): On July 13, 2026, the Department of War (formerly the Department of Defense) suspended CMMC Phase II, which had been scheduled to begin November 10, 2026. The official CMMC announcement states that Phase I self-assessment requirements remain in place. Check your actual solicitations and contracts rather than assume the pause removes a particular requirement.
Your IT provider can affect your assessment scope
Outsourcing IT does not remove your responsibility to understand how your information is protected.
For CMMC Level 2, the scoping rule treats an external provider based on whether it is a cloud provider and whether it processes, stores or transmits Controlled Unclassified Information (CUI) or Security Protection Data.
For example, relevant services supplied by a non-cloud provider handling CUI fall within the contractor’s assessment scope. Services handling Security Protection Data without CUI are assessed as Security Protection Assets. Cloud providers handling CUI follow the applicable FedRAMP requirements.
Ask for a customer responsibility matrix: a document explaining which security responsibilities belong to the provider and which belong to you. Compare it with your service agreement and system security plan.
Seven questions to ask about an IT provider’s SOC 2 report
1. Is it Type 1 or Type 2?
Ask for the report type by name. If the provider has Type 1, ask whether a Type 2 examination is planned and when the report is expected.
Evaluate the answer alongside the provider’s access, responsibilities and importance to your operations.
2. What date or period does it cover?
For Type 1, check the specified date. For Type 2, check when the examination period began and ended, and how long it ran. A full-year period provides more evidence of how controls operate than a period of a few months.
Then look at the gap between the end of the period and today. The wider the gap, the more you should ask about significant changes since the examination and when the next report is expected.
3. Is a bridge letter available?
A bridge letter is a statement from the provider’s management addressing the period after the SOC 2 reporting period, through a specified date.
It can help explain changes during that gap. It does not extend the auditor’s opinion or provide additional independent testing.
Check the letter’s date and read what management actually states.
4. Are the services you need in scope?
Confirm that the report covers the services you would purchase, such as help desk support, security monitoring or backups.
Check which Trust Services categories are included. Also ask whether important subcontracted services are excluded from the auditor’s testing and what evidence is available for those services.
A familiar provider name on the cover is not enough.
5. What did the auditor conclude?
Read the auditor’s opinion, then review the testing results and any exceptions.
An exception does not automatically make a provider unsuitable. Its significance depends on the affected control, the circumstances and the potential impact on your services. Ask what was corrected and whether subsequent testing supports the correction.
A management explanation is useful, but it is not the same as independent confirmation that a problem was resolved.
6. What does the report assume you will do?
Look for complementary user entity controls. These are controls the report assumes customers will implement, such as authorizing access or notifying the provider when an employee leaves.
Compare those assumptions with your internal procedures and service agreement. A responsibility can fall through the cracks when both parties believe the other handles it.
7. Who performed the examination?
Verify the firm behind the report. Confirm that the CPA firm is licensed, has experience performing SOC examinations and has acceptable peer-review results. The AICPA’s Journal of Accountancy has warned that quick-turn SOC engagements promising fast, easy results can undermine the credibility of these reports. Look for a report that clearly explains its scope and findings.
Ask your IT partner for evidence you can evaluate
An IT provider should be able to explain its report, identify the services covered and discuss the responsibilities you share.
Atruent has completed SOC 2 Type 2 examinations three years in a row. Our most recent examination was conducted by Insight Assurance. Our report provides independent assurance about the system and controls within its defined scope. Your organization’s contractual cybersecurity obligations still require their own assessment and evidence.
If you are evaluating an IT partner, start with the seven questions above. Then discuss how the provider’s services fit your systems, information and contract requirements.
Learn how Atruent supports government contractors with managed IT, security monitoring and compliance guidance aligned with CMMC, NIST SP 800-171 and DFARS.
This article provides general information, not legal advice. Confirm your specific contract obligations with qualified counsel or your contracting officer.
