SOC 2 timeline

How long does a SOC 2 take from start to report in hand?

The timeline is set by readiness and remediation, plus the observation period for a Type 2, followed by fieldwork and report issuance. The AICPA does not publish a fixed duration for a SOC 2, so any figure you are given is a planning estimate from someone who has seen your environment. If a customer or contract has a date in mind, start by working backward from it: the due date for the report, the fieldwork window the CPA firm can offer, the period you must have controls running, and the time needed to fix what the readiness work finds. Ask the CPA firm for its own engagement timeline in writing, and ask your readiness provider what it assumes about your current control maturity.

Length varies with the scope you agree on, meaning which trust services categories you add to security, which systems and locations are in the boundary, and whether cloud providers are carved out or included. It also varies with how mature your evidence is. A team that already runs access reviews, change approvals and vulnerability scans with records kept in one place has less to build than one that must start collecting evidence from scratch. For a Type 1, the work is mainly the design of controls as of a date. For a Type 2, the controls must have operated throughout the period, so the calendar cannot be compressed by hiring a consultant. Your organization owns its controls and their operation. An implementation partner can prepare systems, controls and evidence, but only the independent CPA firm can test them and issue the report.

Before you commit to a date, confirm three things: that your controls already operate in the way you describe them, that you have a CPA firm with capacity for your fieldwork window, and that you understand which parts of the timeline sit with you. The AICPA has warned about firms signing reports quickly and about tool vendors promising compliance in weeks or hours. Treat any offer that shortens the Type 2 observation period, or that promises a report without a testing period, as a reason to ask for the reasoning in writing. Plan for remediation time, because exceptions found during testing are a common cause of slippage.

The phases of a SOC 2 timeline and what each produces

A SOC 2 moves in a fixed sequence, from defining the system to a signed CPA report, and each phase hands a specific artifact to the next. Knowing the outputs lets you tell whether the work is actually progressing.

Define the system and categories
Management decides which system, services, locations and subservice organizations fall in scope, and which trust services categories sit alongside security. Security is always covered by the common criteria CC1 to CC9, while availability, confidentiality, processing integrity and privacy are added only when they are in scope. The output is a scope statement that the CPA firm reviews before any testing is planned. You know this step is done when management and the CPA firm agree on the scope in writing.
Assess gaps against the criteria
Management, with an internal team or an outside readiness provider, maps existing policies, processes and technical controls to the Trust Services Criteria and records where they fall short. The output is a gap list that names each missing or weak control, its owner and the criterion it relates to. This step can be done by the organization or with help, but the organization owns the controls. The gap list is complete when every in-scope criterion has a control or a documented reason it does not apply.
Remediate gaps and draft the system description
Teams fix the gaps by writing or updating policies, configuring systems, enabling logging and tightening access, and in parallel draft the system description that management must prepare under the 2018 description criteria (DC 200). Remediation often takes longer than planners expect, because each new control must run long enough to leave evidence. The outputs are a revised control set and a draft system description. The step closes when the draft describes the system as it actually operates, not as it is planned to operate.
Collect the evidence set
Operators gather the records that show each control working, such as access review sign-offs, change tickets, training completions, joiner and leaver records and vulnerability scan results. The evidence is organized against the control matrix so the auditor can request any sample quickly. The output is an evidence set indexed by control and date. This step is complete when a sample of each control can be produced without rebuilding records from memory.
Set the Type 1 date or start the Type 2 period
For a Type 1 report, management fixes a specified date on which the system description and control design are assessed. For a Type 2 report, the observation period starts and controls must operate throughout it, which is why a Type 2 cannot be issued until controls have run over that window. The Journal of Accountancy noted in 2011 that, unlike SOC 1 reports, there is no generally accepted minimum period for a SOC 2 Type 2, so the period should be long enough for the auditor to opine on operating effectiveness and meet user needs. The output is a confirmed date or period recorded in the engagement letter. Ask the CPA firm to state the period it expects and why.
Complete fieldwork and testing
The CPA firm assesses risk, requests evidence, selects samples and tests each control in scope, either at a point in time for Type 1 or across the period for Type 2. Management signs a written assertion and representation letter during this stage. The output is a set of test results with any exceptions documented, which the auditor must describe in the report. This step is done when the auditor has tested every in-scope control and has no open evidence requests.
Issue the signed report
The CPA firm issues its opinion, with the system description, the criteria, the tests performed and the results in the report. Only the independent CPA firm can sign the report, and no internal team or tool vendor can issue it. The output is the signed SOC 2 report, which customers can read under their own use restrictions. Confirm the report date, the period covered and any exceptions before you share it, because readers will check those first.

How the Type 1 date and the Type 2 period set the clock

The timing of a SOC 2 depends on which report you need and when the controls it describes began operating. A Type 1 report addresses the system description and the suitability of control design as of a specified date. A Type 2 report adds an opinion on whether controls operated effectively throughout a specified period. That means the Type 2 clock only starts once controls are running as designed, so the period cannot begin before your access reviews, change approvals, logging and incident procedures exist in practice. Ask your CPA firm to confirm in writing the date the observation period begins, and check that each control has an owner and a recurring evidence trail from day one.

A Type 1 can shorten the time to a first report because the auditor tests design at one date rather than observing operation across months. Starting with a Type 1 gives a customer something to read while the Type 2 period runs, but it does not give the same assurance about operating effectiveness. Plan the two reports as a sequence: confirm with customers whether a Type 1 will satisfy their request, and identify the first Type 2 period they will accept. There is no generally accepted minimum period for a Type 2 report, so ask the CPA firm what period it expects to cover and why, and whether it will be long enough to meet your users' needs.

A bridge letter covers the time between the end of the last Type 2 period and a later date, and it is written by your management, not the CPA firm. Customers often request one when the gap between reports grows, but a bridge letter does not replace the next report. Build the calendar so that the Type 2 period ends and the next one begins without a gap that needs explaining, and assign someone to track the dates each report covers. Note also that the AICPA's SOC 2 Report Walkthrough lists bridge letters among topics report users must understand, so customers may ask detailed questions about them.

What makes a SOC 2 longer or shorter

Most of the calendar time in a SOC 2 comes from decisions made before the auditor starts testing. The six factors below set how much control work, evidence and coordination the examination requires, and each one is partly within the organization's control.

Scope of systems and locations

Every system, product, environment and office placed in scope must have documented controls that the CPA firm can test. A single production platform with one cloud account is far quicker to describe and sample than several products, regions and legacy environments. Before the readiness work starts, list each system that stores or processes customer data and decide which ones the report must cover. Narrowing scope to what customers actually rely on usually shortens the path.

Trust services categories beyond security

Security is covered by the common criteria in every SOC 2. Adding availability, processing integrity, confidentiality or privacy adds criteria, each with its own control design, evidence and testing. Confidentiality and availability often need extra controls such as data disposal records or tested recovery plans, which can lengthen remediation. Ask customers which categories their contracts actually name before adding any.

Subservice organizations and carve-outs

Cloud hosting providers and other vendors that handle customer data are subservice organizations. Including them (inclusive method) means the CPA firm must review their SOC reports and bridge the gaps, while carving them out means the report relies on complementary subservice organization controls that customers must read. Each choice affects how much the auditor must gather from third parties. Collect the vendors' current SOC reports and bridge letters early, and confirm which method the auditor expects before scoping is final.

Evidence maturity

Auditors test controls by sampling evidence from the period, so the speed of the examination depends on whether that evidence already exists in a usable form. Access reviews, change approvals, vulnerability scan results and onboarding records that are stored in a consistent place with dates and sign-offs can be pulled in days. Records that must be reconstructed from chat messages and memory extend the fieldwork and invite exceptions. Test the evidence pull for one control before committing to a start date.

Headcount and change pace

A small team with few engineers and infrequent releases produces fewer changes, fewer access events and fewer tickets to sample. A large organization with many teams, frequent deployments and high staff turnover generates more evidence, more joiner and leaver records and more chances for a control to fail mid-period. Rapid change also means controls may be redesigned during the observation window, which can require explaining the change to the auditor. Consider a release freeze or a change calendar before a Type 2 period begins.

CPA firm capacity and availability

The calendar for fieldwork depends on when the CPA firm has staff available and how many other engagements share its team. A firm that has a booked slot and a clear engagement letter can start on a known date, while an unscheduled request may wait for weeks or months. Ask the firm for its expected fieldwork window, the documents it will request first and who on its team will test each area. Treat any firm that promises a report in days or weeks as a reason to review its peer review results and independence before signing.

Why promises of a SOC 2 report in days or weeks are a warning sign

The AICPA's concern is not that fast work is impossible, but that a SOC 2 report issued in days or weeks often cannot contain what it claims to test. The Journal of Accountancy reported in February 2026 that some tool vendors promise compliance in weeks or even hours, and that the volume of SOC reports being signed within days or weeks may raise regulatory risks for the practitioner firms that sign them. For a buyer, the warning sign is a timeline that skips the parts of the examination that take real time, not a timeline that is simply short. Ask any provider to walk you through how the report date, the period under test and the evidence dates line up before you sign.

A Type 2 report opines on whether controls operated effectively over a period, so the auditor must see evidence that controls ran across that period. A report signed in days can therefore only describe a point in time or a period that was never observed. Ask the provider which report type they are quoting, what period the testing covers, and which dated evidence (access reviews, change tickets, vulnerability scan results, incident records) the auditor will sample. If the answer is that the controls were turned on last week, the report can at most be a Type 1 on design, and the proposal should say so. The May 2026 AICPA peer review alert, as reported by the Journal of Accountancy, takes the same view: when a reviewer concludes that a firm's SOC 2 engagement timelines appear unreasonable, the team captain will likely find elevated risk, and the response may include selecting about five SOC 2 engagements from different partners and comparing them. A firm working under that scrutiny will not hurry its fieldwork, so a fast quote is a reason to check the firm's peer review status, not a reason to relax.

Before you accept any date, ask the provider to put these in writing: the report type and the exact period or as-of date, the name of the CPA firm that will issue the report, the list of controls and the evidence sample sizes the auditor will request, and who is responsible for each step. Confirm the firm's license and peer review results directly with the state board and the AICPA peer review program rather than relying on the provider's summary. Treat any statement that a SOC 2 is certified, guaranteed or complete in days as a question to answer, not a feature. A realistic plan lets you judge progress against dated evidence, and it gives your customers a report that will hold up when they read the testing section.

Who owns each part of the timeline

Your organization owns the controls, the policies and the system the report describes. The SOC 2 is an examination of your statements about your own system, so the people who run that system must make the decisions and sign the statements. Your team also carries most of the calendar, because control operation cannot be bought in a shorter period than the time it takes to run the control.

System description: Your team writes and approves the description of the system, including services, infrastructure, subservice organizations and the complementary user entity controls.
Policies and control ownership: Named owners approve policies, run access reviews, manage changes and respond to incidents, and they keep these records current throughout the period.
Management's assertion: Your leadership makes the written assertion and signs the representation letter the CPA firm requests.
Evidence: Your staff generates, stores and produces the tickets, logs, approvals and screenshots the auditor samples.
Remediation decisions: Your team decides how each gap is closed, who funds the work and when the fix goes live.

Check that each control has a named owner, a documented schedule and an evidence location before the observation period starts.

Questions to ask a CPA firm and a partner about the schedule

A SOC 2 schedule is only as reliable as the scope and evidence behind it. The six questions below help you test whether the CPA firm and any implementation partner can commit to dates that match the agreed system, categories and observation period.

Ask for a phased written timeline

Request a written timeline with dates for each phase: scoping, readiness work, the system description, fieldwork and report issuance. Each date should follow from the scope you agreed, including the categories, the system boundary and any subservice organizations. If a firm gives one end date with no phases, ask what happens to that date when scope changes.

Confirm the Type 2 observation period

For a Type 2 report, ask the firm to state the observation period it expects and the start date it is planning around. The period must be long enough for the auditor to test operating effectiveness, and the controls must have operated throughout it. Ask who decides the length and what the firm does if a control only started part way through the period.

Ask what evidence the firm will request

Ask for the firm's initial evidence request list and the sample sizes it expects to use. Delays often come from late evidence, such as access reviews, change tickets or joiner and leaver records that were never retained. Ask who in your team will own each request and how fast the firm expects a response.

Agree how delays are handled

Ask how the firm reports slippage, what it considers a reasonable cause for a moved date, and whether a change in scope or a late control triggers a new schedule. Ask whether any fee changes apply to delayed fieldwork. Put the answers in the engagement letter so both sides work from the same rules.

Request the firm's peer review results

Ask whether the firm is enrolled in AICPA peer review and whether it can share its most recent peer review report or letter of comment. Ask how the firm responded to any findings about its SOC engagements. A firm that cannot discuss its quality review is harder to hold to a schedule.

Separate the partner from the auditor

Ask your readiness partner to put in writing which tasks it performs and which the CPA firm performs. The partner may prepare systems, controls and evidence, but it should not perform the auditor's testing or issue any opinion. Ask whether the partner's schedule depends on the auditor's, and who signs off that evidence is ready for testing.

Questions buyers ask about SOC 2 timing

How long does a SOC 2 take from start to report?

The total time depends on how ready your controls are when the examination starts, not on a fixed calendar. A typical path runs through scoping, a readiness phase where gaps are found and fixed, the report period or report date, fieldwork by the CPA firm, and report issuance. The duration of each phase depends on your system's size, the number of categories in scope, how many subservice organizations you rely on, and how much remediation the readiness work reveals. No duration is set by the AICPA, so ask your CPA firm for a written timeline that lists each phase, the evidence it expects, and the dates it depends on your team. Be cautious of any offer that promises a report in days or weeks.

Can we get a Type 1 report first and a Type 2 later?

Yes, many organizations start with a Type 1 because it tests whether controls are designed suitably as of a specified date, which is faster to reach than an operating-effectiveness opinion. A Type 1 does not cover operating effectiveness over time, so customers who need evidence that controls ran consistently will still ask for a Type 2. The Type 2 needs controls to have operated across the observation period, so the controls must already be running before that period begins. Ask your CPA firm whether a Type 1 fits your customers' requirements and how the Type 2 period would start after it.

How long should a SOC 2 Type 2 observation period be?

There is no generally accepted minimum period for a SOC 2 Type 2 report. The period should be long enough for the service auditor to form an opinion on operating effectiveness and to meet what users need, which is why the length is a decision made with the CPA firm and your customers. Shorter periods may not satisfy customers who expect a longer track record, and longer periods require controls to run consistently for longer. Confirm the period with the CPA firm before the observation starts, and confirm with key customers what period they accept, since their vendor reviews will set the practical standard.

Does a bridge letter get us through a gap before the next report?

A bridge letter can cover the time between the end of your last Type 2 period and a later date, but it is a statement from your management, not from the CPA firm, and it does not replace the next report. Customers often request one when their vendor review falls in a gap. It only helps if your controls actually operated during that gap and you can support what the letter says with records. Ask your CPA firm what it will say about the letter, and confirm with your customers what wording and dates they expect before you commit to one.

What does the team need to supply each week during the examination?

Expect a steady flow of evidence requests from the CPA firm, often on a shared list, covering policies, access reviews, change tickets, onboarding and offboarding records, vulnerability scan results and incident logs. Most delays come from slow answers to these requests rather than from the testing itself. Practical steps include naming one owner for each control, agreeing a response time with the CPA firm, and keeping evidence in a single repository with consistent dates. Ask the firm for its request list and expected turnaround in writing at engagement start.

Can we run the SOC 2 timeline ourselves without outside help?

Yes, an organization can own the program in-house, but it cannot outsource the responsibility for its controls or the report. The organization designs and operates its controls and produces the evidence, while only an independent CPA firm can examine them and issue the report. Outside help can prepare systems, documentation and evidence, which often shortens remediation, but it does not issue an opinion. Estimate your internal effort honestly, since the readiness work and weekly evidence requests fall on engineering, security and operations staff. Ask any outside party to state in writing what they will deliver and what remains with your team.

How DeployOpen prepares systems and evidence on a fixed scope

DeployOpen plans, implements and documents the self-hosted open-source systems and control evidence that a SOC 2 examination will test, inside your own cloud accounts, data centers or air-gapped networks. We do not issue reports or attestations; the independent CPA firm you engage does, and the timeline it can support depends on the written scope agreed before work starts.

How we scope

Agree in writing which systems, services, locations and trust services categories sit inside the examination period
Confirm the Type 1 date or Type 2 observation period with your CPA firm before any build work begins
Record which subservice organizations are carved out and which cloud controls you will rely on from their SOC reports

How we build

Prepare the infrastructure controls behind common criteria such as CC6 access and CC7 system operations on your own systems
Configure logging, change management and access review workflows so evidence is produced as controls operate
Remediate gaps identified in readiness work, tracking each fix to the criterion it addresses

How we hand over

Deliver a control matrix mapping each in-scope control to its owner, frequency and evidence source
Document the configuration, runbooks and evidence collection steps so your team can repeat them after the report
Provide a walkthrough of the evidence set so the auditor's requests can be answered from a known location

How we support

Offer ongoing support, upgrades and continuous testing as a retainer once the initial engagement closes
Keep evidence collection running through the Type 2 observation period and between examinations
Confirm with your CPA firm which preparation work it can accept, given independence limits on who prepares the evidence