SOC 2 timeline: from readiness to report, stage by stage, and why the examination period sets the pace

The short answer, and what sets the pace

Allow three to six months from kick-off to a Type 1 report and nine to fifteen to a first Type 2. The short end suits companies whose access, logging, change and backup controls already run; the long end, those that must build them, add categories beyond Security or choose a longer first period.

Writing policies and the system description is rarely the slow part. A Type 2 opinion covers how controls operated over a period agreed with the service auditor, and preparation is usually shorter than that period, so protect the date it opens. A Type 2 promised within days cannot be genuine: no period has passed to test.

SOC 2 timeline by stage

The stages follow the six steps on our main SOC 2 page, with the service auditor's work and the optional Type 1 shown separately.

What moves each stage

• Scope and categories. Security is in every report, and each added category brings its own criteria and records, from recovery tests for Availability to consent records for Privacy. An unsettled boundary stalls the gap analysis; SOC 2 scope: system boundaries, trust services categories and carve-outs covers the decision.
• Engineering work. Remediation runs at the pace of engineering changes built alongside the product roadmap. The usual long items are enforced deployment approvals, central logging with triaged alerts, HR-driven leaver removal, access reviews, scanning with fix deadlines and a tested restore.
• Control frequency. The period must contain occurrences to test. A quarterly access review falls twice in six months, but annual activities such as the risk assessment review or an incident-response exercise must be timed inside the period, or there is nothing to sample.
• People. When security rests on one busy person, every approval waits for their diary; a coordinator and deputies keep the plan moving.
• What already exists. Controls operating under ISO/IEC 27001, or mature cloud tooling, shorten remediation but never the period, because evidence must be dated inside it.

What runs in parallel, and what has to wait

During remediation, policies, the system description, awareness training, vendor reviews and the choice of service auditor can all move forward in parallel. Later, a Type 1 can be examined early in the Type 2 period, and on long periods some firms test an interim sample.

Three things cannot be brought forward. The period should not open until every in-scope control operates, since a control switched on in month three leaves months one and two untested and has to be disclosed. The readiness assessment needs records to test. Fieldwork on the whole period waits for it to close.

In SOC 2 the minimum operating period is the examination period itself, agreed with the service auditor. We add three to six weeks of run-in before it, so our readiness assessment tests real records while failures can still be fixed outside the report.

The service auditor's lead times

Your report comes from an independent, licensed CPA firm acting as service auditor, or outside the United States from an equivalent practitioner under ISAE 3000; Sterling prepares you and does not issue it. Choosing a SOC 2 service auditor: what to ask a CPA firm covers selection.

Approach firms once scope, categories and report type are settled, usually in month two or three. Allow four to eight weeks to a signed engagement letter: proposals, a scoping call, the firm's acceptance and independence checks, then terms. A firm can accept a period already under way, but agreeing it first avoids a boundary redrawn mid-period.

Reserve fieldwork weeks when you sign: the report date follows the firm's first available slot, not your period end. Ask how soon testing starts after the period closes, whether an interim sample is tested and how long reporting takes. A Type 1, with no period to sample, sits at the short end.

A worked calendar: 150-person SaaS company, first Type 2

The company runs its platform on one public cloud provider; most staff are remote. The gaps: deployments need no approval, logs go unread, access and vendors have never been reviewed, no backup has been test-restored and risk has never been assessed. Two prospects want a Type 2 covering Security and Availability; sales wants something sooner.

The Type 1 reaches prospects at about six months and the Type 2 at about twelve, inside the nine-to-fifteen-month range. Controls already running at kick-off would open the period earlier, and an accepted shorter first period would bring the report forward; Privacy, a second product or slow fieldwork answers would push it later. SOC 2 implementation plan: phases, owners and deliverables assigns an owner to every step.

SOC 2 timeline: questions buyers ask