Definition
AICPA · SOC 2 guide, AT-C section 205A Type 1 report gives the auditor's opinion on whether your controls were suitably designed at a point in time. A Type 2 report adds an opinion on whether they operated effectively over a period, typically three to twelve months, and includes the tests performed and their results. Buyers ask for Type 2; a Type 1 is a first step when you have not yet run the controls long enough to test them.
Also called SOC 2 Type I and Type II