Considering the SOC framework, what distinguishes a Type $2$ report from a Type $1$ report for both SOC$-1$ and SOC$-2$ audits?

Question $36$ options:

A$)$

Type $2$ reports are only used for SOC$-1$ audits, not for SOC$-2$ audits.

B$)$

Type $1$ reports evaluate the service provider's physical security measures, while Type $2$ reports focus on cyber security.

C$)$

Type $1$ reports assess the design of a service provider's controls at a specific point in time, while Type $2$ reports evaluate the effectiveness of those controls over a period of time.

D$)$

Type $1$ reports are intended for public release, whereas Type $2$ reports are confidential and only shared with specific clients.