What it is
SOC 2 is an attestation report issued by an independent CPA firm. It states whether your controls meet the Trust Services Criteria for security, and for any additional categories you choose: availability, confidentiality, processing integrity or privacy. The report is not a certificate, and no one gets SOC 2 in a single appointment.
The clock starts well before the auditor writes anything. Three phases drive the schedule: readiness, the observation window for a Type 2 report, and audit fieldwork. A Type 1 report covers controls at a single point in time. A Type 2 report covers how those controls operated over a period, usually three to twelve months.
Most delays come from work you control. Policies need approval. Access reviews need a cadence. Logs, backups and vendor reviews need evidence. The auditor's fieldwork is a sampling exercise, so the quality of your evidence folder matters as much as the control itself.
How it works
Step 1, scoping, takes about one to two weeks. Decide the report type, the systems in scope, the trust categories and the legal entities. Write down which customers will receive the report, because their expectations set the period. Include the people, software, cloud providers and subservice organizations that support the in-scope service.
Step 2, readiness, usually takes four to ten weeks. Compare current practice with the criteria. Common gaps are offboarding within a set time, quarterly access reviews, change management tickets, risk assessment, vendor due diligence, incident response testing, and security awareness records. Write or update policies, assign control owners and start collecting evidence in one shared folder. If you need a new logging or device management tool, add two to four weeks for rollout and for the evidence to accumulate.
Step 3, the observation window, applies to Type 2 only. A first Type 2 often uses a three-month window. Some customers ask for six or twelve months, and an annual report is common after the first year. You cannot shorten the window by paying for rush work. Controls must operate across the whole period, with evidence for each occurrence. If you start the window before controls are live, you create exceptions.
Step 4, audit fieldwork, takes about three to six weeks. The CPA firm sends a request list, samples controls, interviews owners and reviews evidence. You respond to follow-ups, then the firm drafts the report, runs quality review and signs. Leave one to two weeks for corrections. A Type 1 can finish in eight to twelve weeks from a clean start. A first Type 2 commonly takes five to eight months from kickoff, with the observation window as the long pole.
Why it matters for a business
The report date is a sales and contract issue, not just an IT project. Enterprise buyers and security questionnaires often ask for a SOC 2 report before they will sign or expand. If you promise a date, work backward from the observation window and the auditor's schedule. A realistic plan protects the deal and the team.
The schedule sets the budget and staffing. Readiness work pulls in engineering, HR, legal and finance. Evidence collection needs a named owner and a recurring calendar. Auditors charge for time, so a clean evidence folder and a stable scope reduce back and forth. Changing scope mid-window is expensive.
Choose the report type with the customer in mind. A Type 1 can show that controls are designed well at a point in time. A Type 2 shows they operated. Some buyers accept a Type 1 while the Type 2 window runs. Others require the Type 2 before renewal. Ask before you commit.
Common mistakes
Starting the observation window before controls operate is the most costly mistake. Every missed access review or late offboarding becomes an exception that the auditor must describe. Run controls for a full cycle in a test month, then open the window.
Choosing an auditor too late is another. Good firms book weeks or months ahead, especially near fiscal year end. Shortlist two or three firms during readiness, confirm they have experience with your stack and ask who will do the fieldwork. Do not assume a compliance tool replaces readiness. Tools store evidence; they do not fix a missing approval or a broken backup test.
Scope creep and weak evidence ownership also hurt. Adding systems or entities after scoping restarts parts of the work. A folder owned by one person who leaves creates a gap. Keep a control matrix with owner, frequency, evidence location and last test date. Review it monthly.
How to get started
Build a one-page timeline with four lanes: scope, readiness, observation and audit. Put dates and names on each item. Pick the report type and period first, then confirm the auditor's availability. Set a weekly evidence check for the controls that run most often, such as access reviews, backups and change approvals.
Run an internal dry run two weeks before fieldwork. Pick one sample for each control and see if you can produce it within an hour. If not, fix the filing system first. Prepare the management assertion and system description early, because the auditor will need them for the draft.
If you want a structured start, the SOC 2 readiness assessment from Cloudverg is a fixed price of $7,500 and runs for three weeks, with scoping, a gap assessment against the Trust Services Criteria, a policy and evidence inventory, a remediation roadmap and a shortlist of CPA firms. It starts within 10 business days. It is one option among several, including hiring a consultant or doing the readiness work in-house.
Frequently asked questions
How long does a SOC 2 Type 2 take?
For a first-time team, plan five to eight months from kickoff. That includes four to ten weeks of readiness, a three-month observation window often used for a first report, and three to six weeks of fieldwork and report drafting. If controls already operate and evidence is clean, the schedule can be shorter, but the observation window cannot be compressed.
Can we get SOC 2 in 30 days?
A Type 1 may be possible in about eight to twelve weeks if controls are already designed, evidence exists and an auditor has capacity. A Type 2 cannot fit in 30 days because the auditor must observe controls over a period. A three-month window alone sets the floor.
Does the observation window have to be 12 months?
No. A first Type 2 often uses a three-month window. Customers or contracts may ask for six or twelve months. Many companies move to an annual twelve-month report after the first cycle. Confirm the expected period with your buyers before you start.