Think you might mean SOC II Type 1 and SOC II Type 2 (vs SOC I)? SOC II Type 1/2 cover the "scopes" that more generally pertain to "secure" development. A SOC

Think you might mean SOC II Type 1 and SOC II Type 2 (vs SOC I)? SOC II Type 1/2 cover the "scopes" that more generally pertain to "secure" development. A SOC II Type 1 is basically coming up with that checklist. The third-party auditor will then measure your performance against that checklist (you provide the evidence) for a single point in time. The Type 1 is considered the baby step into the Type 2. A SOC II Type 2 is generally taking that checklist from the Type 1... but the auditor is randomly sampling for evidence over a time range (usually a year). Generally once you've done your first Type 2... you're doing it continually each and every year.