Dean Mead, a law firm with offices in Fort Pierce, Naples, Orlando, Vero Beach, and the Space Coast, announced on October 6 that it had cleared all 86 audit questions in a SOC 2 Type I assessment, which concluded in September. The final Type I report is expected in November. The same announcement states that the firm's SOC 2 Type II observation period — the part that tests whether those controls actually held up — doesn't start until January 2027, and the firm expects it to run through December 2027.
That's not a knock on the firm. It's a dated example of a distinction flattened in almost every other SOC 2 announcement: Type I and Type II answer different questions, and vendor-risk paperwork often never checks which one it's holding.
What Type I actually certifies
A law firm's estate planning, M&A, tax controversy, and trust litigation files are dense with Social Security numbers, account statements, and settlement terms — the inventory SOC 2 exists to protect, and the inventory an attacker wants. So the instinct to pursue the certification is sound. The part worth being precise about is what "cleared 86 audit questions" means on its own.
SOC 2 Type I is a design review: an auditor looks at your control set — access provisioning, encryption, logging, incident response — on a single date and confirms the controls are designed to meet the relevant trust services criteria. It says nothing about whether those controls were followed last Tuesday, whether an exception got logged and ignored, or whether the access-review control anyone described to the auditor is the one actually run every quarter. SOC 2 Type II is the test of that: the same controls, observed operating over a period — here, the twelve months from January through December 2027 — with every exception the auditor finds written into the report.
The reason this distinction keeps getting skipped isn't dishonesty. A Type I pass is a real, auditable milestone, and firms announce it the day they clear it because the Type II result is, by definition, not available yet. The gap is structural: between a Type I pass and a completed Type II period, "SOC 2 compliant" is true in a narrower sense than most readers assume, and nothing in a one-paragraph press release is obligated to spell out which sense applies.
What to actually check in a SOC 2 claim
"SOC 2" is not one fact. Four things in the report answer different questions, and a vendor-risk review that skips them is reading the cover page.
The letter. Type I is a point-in-time design opinion. Type II is an operating-effectiveness opinion over a stated period. A vendor who says "SOC 2 certified" without the letter is usually, not always, telling you it's Type I — Type II is the one firms specify, because it's harder to get.
The dates. A Type I report names a single "as of" date. A Type II report names a start and end date for the observation window. Either can be stale. A Type II report covering January through December 2024, cited in a 2026 contract renewal, describes controls two years ago, not controls today — and renewal cycles are exactly when this check gets skipped, since the report was already on file.
The scope. SOC 2 has five trust services criteria — security, availability, processing integrity, confidentiality, privacy — and an organization chooses which ones its audit covers. A report scoped to security alone says nothing about how the vendor handles data retention or confidentiality controls, even if the vendor's marketing page doesn't make that distinction.
The exceptions. The report's actual findings section lists any control that didn't operate as described during the period, and whether the auditor judged it material. "No exceptions noted" and "one exception, remediated in month four" both result in a published SOC 2 report; they are not the same vendor.
Getting past the cover page costs something real: a signed NDA to see the full report rather than the one-page attestation letter most vendors hand over by default, and twenty minutes actually reading the scope and exceptions sections instead of filing the PDF. That's the whole cost, and it's the difference between a vendor-risk file that says "has SOC 2" and one that says what SOC 2 actually covers, as of when.
What to check this week
- For any vendor or partner citing SOC 2 in a contract or security questionnaire, confirm which letter — Type I or Type II — and ask for the actual report, not the badge.
- Check the as-of date (Type I) or the period start and end (Type II). If the window is more than a year old, treat the claim as unverified for anything after it.
- Check which trust services criteria are in scope. Security-only is common and doesn't cover confidentiality or availability claims.
- Read the exceptions section yourself rather than accepting a vendor's summary of it.
- If a vendor only has a Type I report, calendar the date their Type II observation period ends and follow up for the completed report — don't assume Type I rolls forward into Type II automatically.
A vendor's unverified security claim is the same risk in a different wrapper: a statement that's true as far as it goes, cited as if it answered a question it doesn't.
North InfoSec runs the penetration tests that typically sit alongside a SOC 2 Type II audit as evidence for the security criteria — a different check than the audit itself, not a substitute for either. northinfosec.com