SOC 2 Type 2
The version of a SOC 2 report that tests whether controls actually worked over a defined observation period.
Type 1 says the controls were designed properly on one day. Type 2 says they were followed consistently for months, which is what a serious buyer wants to see.
The observation period is where organizations struggle, because it requires evidence of every control operating continuously. Access reviews that were skipped and patching that lapsed both show up as exceptions.
Where this comes up
SOC 2 Type 2 sits inside our compliance and frameworks work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.