How long is a SOC 2 report valid

How long is a SOC 2 report valid, and why the answer depends on the report period

A SOC 2 report carries no expiry date. Its opinion is tied to a single date for a Type 1 report or to a specified period for a Type 2 report, yet most customers treat a report as current for about a year. When a customer or contract asks for a current SOC 2, the useful question is not whether the report has expired but how far its period ends from today, and whether the contract says what the customer is entitled to receive. The answer differs for each organization and for each provider, so it has to be read from the report and the agreement, not from a rule of thumb.

Start with the period end date printed in the report's opinion and the contract's report clause. If the contract asks for a report at a stated frequency, the customer may be entitled to a new report on that schedule regardless of the period end. If it is silent, confirm with the customer which period they consider acceptable, because management determines the period covered by a Type 2 report and no generally accepted minimum exists. Also check whether the report covers the services and categories the customer buys. A report that is recent but scoped to a different system is not a substitute.

Where the gap between the period end and today is too wide, a bridge letter covers the time since the last period. Large cloud providers publish them on a schedule: AWS updates its SOC Continued Operations Letter monthly in AWS Artifact, and Azure supplements its reports with bridge letters issued each quarter. Your own organization should plan the same thing: schedule the next examination window, agree with the CPA firm when the report will be issued, and ask the firm or your implementation partner what evidence supports the bridge period. Your organization owns its controls, a partner such as DeployOpen prepares systems and evidence for the examination, and only the independent CPA firm issues the report and any bridge letter.

What a Type 1 and a Type 2 report each tell the reader about time

A SOC 2 Type 1 report covers the service organization's system description and the suitability of control design as of a specified date. The service auditor's opinion asks whether the controls, as designed at that moment, would meet the applicable Trust Services Criteria if they operated as described. It does not test whether anyone followed those controls over time. For a reader, the Type 1 opinion is a snapshot. It tells you the vendor had a designed control set in place on that day, and it says nothing about whether those controls ran in the weeks and months that followed.

The anchor is a single date: The report names one as-of date, and every design conclusion in it speaks only to that date.
Design, not operation: The auditor evaluates whether controls are suitably designed, not whether they produced consistent results.
Changes after the date fall outside the opinion: A new hire process, a changed cloud configuration or a retired control after that date is not covered.
Useful as a first step: A Type 1 can show that a vendor has committed to a control set before it has a track record, which is why early-stage vendors often hold one first.
Weaker evidence of consistency: Because operating effectiveness is untested, a Type 1 alone does not show that controls worked.

Before relying on a Type 1, check the as-of date against the date you are making the decision, and ask the vendor what has changed since then.

How contract clauses set the maximum age a customer accepts

The customer usually sets the maximum acceptable age of a SOC 2 report, and it does so in the contract, not in the report. The report itself carries no expiry date. What a customer can demand is set by clauses that define which SOC reports the vendor must deliver and how often. The 2023 interagency guidance on third-party relationships suggests that contracts specify the types and frequency of audit reports, such as SOC reports, that a bank is entitled to receive from a third party. That guidance is written for banks, but many vendors to regulated buyers now see the same language in their security addenda, and a vendor's own paper may not match it.

A proposed successor, the 2026 third-party risk management guidance published for comment in the Federal Register, would carry the same expectation forward. It is a proposal only, so do not treat it as an obligation until it is finalized. Whatever the regulator says, your clause decides what you get. Read the clause for three things: the report types named (SOC 2 Type 2, SOC 3, or a SOC 2+ report), the frequency of delivery, and any requirement for a bridge letter when the newest report period has ended. If the clause says "annual SOC 2 report" and does not mention bridge letters, a report that is eleven months old may be compliant on the day it is sent.

Check the clause, do not assume a year. Vendors and buyers often carry a default of twelve months in their heads, but the contract is what the vendor has agreed to deliver. Ask your legal or procurement team to confirm the wording before you sign, and ask the vendor to confirm the most recent period end date and when the next report is due. If a clause is silent, add one that names the report type, the delivery interval and the bridge letter requirement, and record the agreed dates in your third-party register so that a missed report is caught before your own examiner finds it.

How bridge letters cover the gap between periods

This sequence tells a reader how to bridge the time between the end of the last SOC 2 report period and today, so the decision to rely on the report is documented and defensible.

Note the end date of the latest period
Start by recording the period end date of the report you hold, and for a Type 1 report the date it speaks as of. Confirm this against the opinion section of the report, not the cover page or the marketing summary. Write the date in your vendor file so every later step measures from the same point. The check is done when the date and the report's section reference sit together in the file.
Ask the provider for a bridge letter
Request a bridge letter from the provider, usually through its account or compliance contact, and state the period you need it to cover. The provider's management prepares and signs the letter, so the request goes to the provider rather than the CPA firm. Ask for the letter's date and the period it addresses. The step is complete when you have a dated letter in hand or a written answer that none is available.
Confirm the letter's coverage window
Check that the letter's coverage starts where the last report period ended and runs to a date close to your review. Gaps at either end mean the letter does not bridge the time you care about. Where a provider publishes a standing continuity letter, confirm which period it addresses and how often it is refreshed. Record any uncovered days as an open item for follow-up with the provider.
Check for changes to scope and systems
Compare the services, locations, subservice organizations and system components named in the report with what you buy today. Look for new products, migrations, acquisitions or changed hosting regions that the report may not describe. Ask the provider to state in writing whether any of these changes affect the controls in the report. Done when you have either a confirmed match or a list of differences to resolve.
Ask about incidents and exceptions since the period
Ask the provider whether any security incident, control failure or material change has occurred since the period ended, and whether it affected the controls under review. Ask how exceptions in the last report were remediated, if any were reported. A bridge letter does not test these events, so the answers come from the provider's disclosure. Record the answers and their date in the vendor file.
Confirm with the CPA firm what its role covers
Ask the CPA firm named in the report whether it issued or reviewed the bridge letter and whether its engagement covers any opinion on the gap. In most cases the letter is a provider document and the CPA firm does not express an opinion on the gap period unless its engagement says so. Obtain that answer in writing, or a copy of the engagement terms, before you rely on the letter for a decision.
Record the reliance decision and its limits
Write a short decision note stating the report period, the bridge letter's coverage, the scope check, incident answers and the CPA firm's confirmation. State what remains uncovered and whether you accept it, need a new report, or need additional contract terms. Set a review point for when the next report is due under the contract. The step is complete when the note is filed and the responsible owner has signed off.

How AWS and Azure schedule their SOC reports

Two large cloud providers show how a SOC 2 cycle can run on a fixed calendar and how bridge letters fill the gap between report periods. Their schedules differ, so the cards below compare the mechanics and name what a reviewer should check in each.

AWS twice-yearly report periods

AWS issues its SOC 2 and SOC 3 reports twice a year, each covering a 12-month period that ends on March 31 or September 30. Because the periods are fixed, a customer can tell in advance which report should be current at any date. Check that the period in the report you hold is the one you think it is, and that the services you use appear in its scope.

AWS release lag and bridge letter

AWS says its SOC reports are typically released about 9 to 10 weeks after the period ends. In the gap before a new report arrives, the SOC Continued Operations Letter covers the time since the last period and is updated monthly in AWS Artifact. Ask your procurement team to file the current letter with the report so the coverage gap is documented.

Azure rolling audit period

Azure SOC reports use a rolling 12-month audit period, with new reports issued semi-annually for periods ending March 31 and September 30. Because the audit window moves forward, each new report overlaps the previous one. A reviewer should confirm which period the report in hand covers rather than assume it matches the calendar year.

Azure quarterly bridge letters

Azure publishes its full reports about six weeks after the period closes and supplements them with bridge letters issued in the first week of each quarter. Both are available from the Service Trust Portal. Download the most recent bridge letter at each renewal of your own vendor review so the file shows coverage up to the current quarter.

Comparing the two cycles

Both providers use 12-month periods and bridge documents, but they differ in the timing of their reports and the frequency of bridge letters. A procurement team comparing vendors should line up each provider's period end, publication lag and bridge cadence in one table so that the gap they must cover is visible for every supplier.

Check your vendor's own cycle

A vendor's cycle may differ from the AWS and Azure examples. Ask for the period end date, the expected publication date for the next report, and the bridge letter frequency before you rely on any document. The contract should name the report types and frequency you expect to receive, so a missed cycle becomes a contractual issue rather than a surprise during due diligence.

What to check before accepting an older SOC 2 report

A SOC 2 report describes a past period or date, so accepting one means testing whether it still describes the service you are buying. The cards below separate the checks you can make from the report alone from the ones that need the vendor or the CPA firm.

Period end date against purchase date

Start with the period a Type 2 report covers, or the as-of date of a Type 1 report, and compare it with the day you are signing. The gap between the two is the window where nothing in the report speaks to your service. Check the period end on the report's opinion page, not the cover, because the cover date is often the issue date. You can do this check yourself in minutes, and it decides whether the rest of the review is worth doing.

Scope and systems still match

Compare the systems named in the system description with the product, regions and environments you will use. A report covering a product line you no longer buy, or one that predates a new hosting region, tells you little about your data. Ask the vendor whether any system, data flow or product was added, retired or moved after the period ended. This check needs the vendor's answer, because the report alone cannot show changes made since.

Exceptions and qualified opinions

Read the testing section of a Type 2 report for exceptions, which are control deviations found in sampled tests, and check the opinion type for any qualification. An exception does not automatically disqualify a vendor, but an unexplained exception or a qualified opinion in an older report should prompt questions about what changed since. Look at management's responses and whether the same control failed in the period before. You can read this section yourself, but the vendor must explain remediation.

Bridge letter for the gap

A bridge letter, sometimes called a continued operations letter, is management's written statement covering the time between the report period end and today. Its existence does not make the report current, and it is not an audit opinion, but it shows the vendor is tracking its controls. Ask whether one exists, what period it covers, and whether it reports any known control failures. Only the vendor can provide it, so request it before signing rather than after.

Subservice carve-outs and changes

Check whether the report carves out subservice organizations such as cloud hosts, or includes them. If the report uses the carve-out method, the vendor's own report does not test those providers, so you need their reports too. Confirm whether the subservice list has changed since the period, for example a new payment processor or a new cloud region. Ask for current reports from any subservice provider whose controls matter to your data. This check needs the vendor, and the answer should match the report's own list.

CPA firm independence and licensing

Confirm that the firm that signed the report is a licensed CPA firm that is independent of the vendor. A report signed by a firm without a valid license, or one that also designed the vendor's controls, carries less weight. You can check the firm's name and the signing partner's license with the relevant state board of accountancy, and ask the vendor to confirm the engagement was independent. Verifying licensing is something you can do yourself, although it does not prove the examination itself was performed well.

How to set a SOC 2 cycle your customers will accept

The most useful decision a service organization makes about its SOC 2 cycle is the end date of its Type 2 observation period, because that date determines how old the report will look to buyers by the time they read it. Choose the period end by working backward from when your largest customers send their vendor reviews and renewal questionnaires, not from when your auditor happens to have capacity. Check the publication lag with your CPA firm before you fix the date, since the report is issued by the firm after fieldwork and review, not by your team. Confirm in writing with the firm what their typical time from period end to issued report is for an organization of your size, and build that into the calendar.

A gap between periods is what prompts questions, not the report's age alone. A customer reading a report whose period closed several months earlier will ask what happened in the time since, and a bridge letter is the usual answer. Commission one from your CPA firm when a major renewal, a bank or regulator-linked due diligence, or a new report period is about to be reviewed by a buyer, and ask the firm what the letter covers, who signs it, and whether it describes exceptions or incidents in that window. Your team prepares the evidence for the gap period in the same way it prepares the examined period, so that the letter can be supported without a scramble. DeployOpen can prepare systems, control evidence and the change and access records a bridge letter depends on, but the controls remain yours and only the CPA firm issues the letter.

Finally, write the cycle into your contracts and your customer communications before a buyer asks for it. Record the report types and frequency you commit to, including any bridge letter obligation, so that the commitment matches what you can deliver. If a period is likely to include a material platform change, acquisition or open incident, raise it with the CPA firm early, because the description of the system and any exceptions will shape how the report reads. Keep a short calendar showing period start, period end, expected publication and the date your next report period begins, and share it with account owners so the answer to "is our report current" is ready before the question arrives.

Questions buyers ask about SOC 2 report currency

Does a SOC 2 report expire?

No. A SOC 2 report has no expiry date printed on it, but its opinion is tied to a specific point in time or a specific period. A Type 1 report speaks as of a date, and a Type 2 report gives an opinion on operating effectiveness across a stated period, so the report describes what was true then. Customers treat the report as current for roughly a year because most providers issue a new report on a recurring cycle. Whether that cycle satisfies you depends on the period end date and what your contract requires, so check the dates on the report rather than the issue date on the cover.

What do customers usually accept when a SOC 2 report is older?

There is no universal rule, so acceptance depends on your contract and your third-party risk program. Many buyers accept the most recent report plus a bridge letter that covers the gap between the end of the report period and today. Contracts may also specify the types and frequency of audit reports a customer is entitled to receive. The 2023 interagency guidance on third-party relationships suggests that contracts specify these reports, so ask your legal and procurement teams what frequency your agreement already requires. Confirm the exact wording in the contract before assuming an older report will pass review.

What is a SOC 2 bridge letter and when do you need one?

A bridge letter is a short letter from the service organization's management that covers the time between the end of the last report period and a later date, usually the present. It states whether management is aware of material changes to controls or systems and whether any significant incidents occurred in that gap. It is not a new audit and carries no service auditor opinion on the gap period. You typically need one when the most recent report period ends well before a customer's review date. Hyperscale providers publish their own bridge letters on a regular schedule, for example Azure supplements its reports with bridge letters issued in the first week of each quarter, so check whether your provider offers one through its trust portal.

Can an implementation partner issue or update a SOC 2 report?

No. Only an independent CPA firm performing a SOC 2 examination can issue a SOC 2 report. An implementation partner, such as DeployOpen, can help prepare the systems, controls and evidence that the examination tests, but the organization owns its controls and management signs the assertion and representation letter. Updating the report period, writing a bridge letter for management's signature, or re-issuing an existing report is also the organization's responsibility, with the CPA firm involved wherever a formal opinion is required. Ask any partner to put this division of roles in writing before work starts.

How does the SOC 2 reporting cycle affect cost and effort?

The cost of a Type 2 program is driven mostly by how often you examine, how much evidence the auditor samples across the observation period, and how much preparation happens before fieldwork. An annual cycle means one examination fee and one evidence collection effort each year, while a shorter cycle or a larger number of changes during the period increases both. The audit firm's fee should be quoted from the agreed scope and period. Ask the firm to separate the examination fee from any readiness or consulting work, and ask which costs recur when you change the period end date or add a category. Confirm these figures with your CPA firm and implementation partner, since no fixed price applies across organizations.

What should I ask a vendor about their SOC 2 report dates?

Ask for the most recent report, its exact period start and end dates, and the scope of systems and categories covered. Then ask whether a bridge letter is available for the period since the last report and when it was last updated. Request the vendor's schedule for the next report, including the expected release window, and confirm whether any control exceptions in the current report have been remediated. For cloud providers, check their compliance portal, where many publish reports and bridge letters on a set cadence. Also ask whether any acquisition, platform change or significant incident has occurred since the period end, because those events may require disclosure or a supplementary letter.

How DeployOpen helps organizations keep SOC 2 evidence current

DeployOpen prepares the systems, controls and evidence that keep a SOC 2 program current between examinations, inside your own infrastructure. We do not issue reports or bridge letters; your independent CPA firm does. Engagements start with a written scope so you know exactly what evidence is produced and when it is handed over.

How we scope

Confirm which report period, Type 2 window and reporting dates your customers and contracts actually require.
Map the in-scope systems, subservice organizations and complementary user entity controls that affect report currency.
Agree the evidence calendar in writing before work starts, so every control has a named owner and collection date.

How we build

Set up self-hosted open-source tooling that collects access reviews, change records and logging evidence on a recurring schedule.
Configure infrastructure as code so control settings stay consistent across the period and can be shown to an auditor.
Test each control between examinations so gaps appear during the period rather than at the next fieldwork.

How we hand over

Deliver a written evidence index that maps each control to its recurring artifacts and the period each one covers.
Document change logs for the system description so significant platform changes are recorded when they happen.
Brief your internal team and CPA firm on what the evidence shows, while the independent auditor retains sole responsibility for opinions.

How we support

Offer ongoing support and upgrades as a retainer, scoped separately from the initial implementation.
Provide continuous testing and monitoring retainers so control drift is caught before a bridge letter request arrives.
Confirm with your CPA firm which bridge letter timing and content they expect, and plan the evidence to match.

How long is a SOC 2 report valid