What is the difference between SOC 1 and SOC 2?

The distinction between SOC 1 and SOC 2 is about what is being evaluated and who uses the report.

SOC 1 (SSAE 18 / AT-C 320): SOC 1 reports address controls at a service organization that are relevant to a user entity's Internal Control over Financial Reporting. The audience is primarily the user organization's financial auditors and management. The key question is: does this service organization's processing affect how customers state their financials? Examples of SOC 1-relevant service organizations include payroll processors, insurance claims processors, loan servicing companies, and data center co-location providers that affect IT General Controls relevant to financial systems. SOC 1 does not directly address security as a primary objective - it addresses whatever controls affect the user's financial reporting.

SOC 2 (SSAE 18 / AT-C 205): SOC 2 reports address controls relevant to the Trust Service Criteria defined by the AICPA: Security (required baseline), Availability, Processing Integrity, Confidentiality, and/or Privacy (all optional additions). The audience is customers, prospects, regulators, and business partners evaluating the service organization's controls. Examples include SaaS platforms, cloud infrastructure providers, managed security service providers, and any technology company storing or processing customer data.

Type I vs. Type II applies to both report types: Type I assesses design at a point in time; Type II assesses operating effectiveness over a period.