SOC 2 Type 1 vs Type 2 evidence is the difference between "we designed a control" and "the control operated for the period." Type I is a point-in-time report on design. Type II samples operating effectiveness across an observation window — often three, six, or twelve months. Teams that reuse Type I folders (one access-review export, one scanner PDF, one policy PDF) fail Type II for a mechanical reason: the auditor cannot see the control in month four.
The AICPA Trust Services Criteria do not change between Type I and Type II. The evidence shape does. Rutagon builds pipelines that emit dated artifacts for each period. We do not hold a SOC 2 attestation. We do not issue your report. We keep Type II from being a Type I folder with a new cover sheet.
What Actually Changes
Timestamps. Type I can survive "as of May 1." Type II needs artifacts whose dates fall inside the window, repeatedly. A CloudTrail org trail that was turned on in month ten does not evidence months one through nine. Write the gap. Do not backfill fiction.
Sampling. Type II auditors pick items from the period: a termination in July, a vuln in September, a guest in November. If your only access review is December, July has no campaign. NIST SP 800-53 Rev. 5 does not invent SOC 2, but AU-2 / AC-2 language is the same idea: generate and review records over time (NIST SP 800-53 Rev. 5).
Observation coverage. "We do this quarterly" means four seals, not one heroic seal and three calendar invites. Missed quarters are findings. All-retain quarters are valid if they exist.
Population completeness over time. Systems added mid-window must enter the next campaign. A new admin panel that shipped in month three and never entered the access-review population is a scoped miss, not a footnote.
SOC 2 Type 1 vs Type 2 Evidence We Build
We treat each control as a time series.
def seal_period(control_id, period, rows, decisions, remediations):
return {
"control_id": control_id,
"period": period,
"row_count": len(rows),
"snapshot_sha": hash_rows(rows),
"decision_sha": hash_rows(decisions),
"remediation_sha": hash_rows(remediations),
"gaps": list_gaps(period, rows),
"sealed_at": utcnow().isoformat(),
}
Type I can use the latest seal plus design docs (policies, architecture, Terraform). Type II needs the series. We store seals in object storage with the same retention as your log account and attach them to GRC custom tests by period. See audit sampling evidence automation and continuous access review for Type II. SOC 2 access review is the CC6 instance of this shape. Capability: security automation.
Type I Artifacts That Break Type II
- A policy PDF with no execution log
- One vulnerability scan the week of kickoff
- An access-review spreadsheet with no campaign dates
- CloudTrail enabled "for the audit" mid-window
- Screenshots without a hash or a population query
- Exceptions with no expiry that span the whole window silently
We map each of those to a job: campaign calendar, scanner-to-ticket join (CC7.1), org trail from day one of the next window, sealed hashes. If the current window is already running, we start the series now and write the dated gap. Auditors prefer an honest gap to a reconstructed past.
Sampling Without a War Room
When the auditor picks "termination on 12 June," Type II evidence is: HR event time, IdP disable time, GitHub/M365/AWS revoke times, and the quarterly campaign that would have caught residue. If those timestamps are only in Slack, the control did not operate. We pull them from APIs into the same evidence row. Joiner-mover-leaver automation is the event path; the campaign is the backstop.
When they pick a high CVE, Type II is first-seen, ticket, SLA, exception or patch, retest — inside the window. A Type I "we have Tenable" letter does not survive that pick.
How This Plugs Into the GRC Tool You Already Run
The platform is good at requests and auditor users. It is not good at manufacturing a year of missing seals. We do not tell you to cancel it. We push period objects into custom tests. If the vendor can only hold one attachment per control, we attach a manifest that lists object-storage URIs for Q1–Q4. Ugly and complete beats pretty and single-shot.
Rutagon does not hold FedRAMP authorization or a SOC 2 report. "Aligned" means the evidence shape matches how Type II is sampled. It is not a certification.
Change management is the other Type II surprise. A Type I packet can include "we use Terraform." Type II wants tickets and deploys inside the window, plus a sample that a production change was reviewed. We do not become your ITSM vendor. We make sure deploy logs (GitHub environment approvals, CodePipeline, or your existing ticket) are queryable by date so the sample is not a Slack archaeology project.
Access reviews, vulns, logging, and change: those four series cover most first Type II pain. Pick the one the last auditor already flagged and make it a series first. Boiling the ocean into twenty custom tests with one seal each is how you are still Type I in month eleven.
People coverage matters as much as system coverage. A Type II window that hired twenty contractors needs those contractors in the joiner-mover-leaver series, not only in a December access review. If your HRIS does not emit contractor end dates, that is an evidence gap we write down and then automate if the HRIS API allows. Honesty in the gap list is cheaper than a qualified report. The gap list itself is a sealed artifact with dates, not a hallway conversation.
Ask us what your GRC platform isn't covering →
907-841-8407 · contact@rutagon.com
Frequently Asked Questions
Can we go straight to Type II without Type I?
Some firms do. The engineering is the same series. Skipping Type I does not skip the need for dated operation. It just means the first report is already a window.
How long should the first Type II window be?
Long enough that sampling is meaningful and short enough that you can actually run the jobs. A twelve-month window with three months of pipeline is a gap letter. We would rather start a shorter window the day the jobs are live.
Do policy documents still matter in Type II?
Yes, as design. They do not replace seals. A policy that says quarterly plus four missing quarters is a design-vs-operation fail.
What if we changed GRC vendors mid-window?
Keep the old artifacts. The observation is about your controls, not the vendor logo. We migrate the series, we do not delete last quarter because the portal changed.
Will Rutagon sign the report?
No. Your CPA firm does. We make the sample boring.