Which of the following System and Organization Controls (SOC) report types should an organization request if they require a period of time report covering security and availability for a particular sy

SOC 1 Type 1 assesses controls relevant to financial reporting at a single point in time, not over a period, and does not address security or availability Trust Service Criteria.

SOC 1 Type 2 covers financial reporting controls over a period of time, but it is scoped to internal controls over financial reporting (ICFR), not security or availability.

SOC 2 Type 1 does address security and availability Trust Service Criteria, but it only reflects the design of controls at a single point in time rather than their operating effectiveness over a period.

SOC 2 Type 2 evaluates controls relevant to the Trust Service Criteria (including security and availability) over a specified period of time, typically 6-12 months, providing evidence that controls were operating effectively throughout that period. This distinguishes it from a Type 1 report (point-in-time) and from SOC 1 (which focuses on financial reporting controls). It is the standard report requested when ongoing operational effectiveness for security and availability must be demonstrated.