What is the difference between and SSAE18 Type 1 and Type 2 Report?

Type I –   A report on policies and procedures placed in operation as of a specified point in time. SSAE 18 type I reports evaluate the design effectiveness of a service provider’s controls and then confirms the controls have been placed in operation as of a specific date.

Type II – A report on policies and procedures placed in operation and tests of operating effectiveness for a period of time. SSAE 18 type II reports include the examination and confirmation steps involved in a type I examination plus include an evaluation of the operating effectiveness of the controls for a period of at least six consecutive calendar months. Most user organizations require their service provider to undergo the type II level examination for the greater level of assurance it provides.

Shopping Cart