A SOC 2 Type II report differs from Type I in that it:
A CISSP practice question covering Domain 6: Security Assessment and Testing. Try answering before reading the explanation below.
Show options & answer
Why "Covers operating effectiveness of controls over a period (typically 6-12 months)" is the right answer
SOC 2 Type I evaluates control design at a point in time. Type II adds operating-effectiveness testing over a defined audit window (commonly 6 or 12 months). Both are performed by independent CPAs, not internal audit. SOC 2 is voluntary, not SOX.
Take the full CISSP practice test
120 questions, instant explanations, study-video links on every miss. No account.