Home › Guides › Timeline

How long does SOC 2 take?

Updated 2026-09-06 · 6 min read · by Deepak Gandhi, who builds SOC2Starter

Every other cost in SOC 2 can be bought down. Time cannot. The observation window on a Type 2 report is calendar time, and no amount of money, tooling or consulting compresses it — which makes the timeline the single most important thing to understand before you promise a date to a customer.

The four phases

Realistic totals

• Type 1, from nothing: 2–4 months.
• Type 2, from nothing, 3-month window: 6–9 months.
• Type 2, from nothing, 12-month window: 14–18 months.
• Type 2, when you already run the controls: the window plus fieldwork — 4–6 months.

A first Type 2 usually uses a three-month window, with subsequent reports moving to six or twelve so coverage is continuous year to year.

Why the window cannot be shortened

A Type 2 opinion is about whether controls operated effectively over a period. The auditor samples: if your policy says access is reviewed quarterly, they check each quarter in the window. There is no version of that which runs faster than the calendar.

Worse, the window covers whatever was genuinely happening during it. Open it while you are still fixing offboarding and the auditor will find the two months when offboarding did not work, and that exception is printed in the report your customers read. Get the controls working, then open the window. Starting late is slower than starting right.

What actually causes delays

1. Evidence that has to be reconstructed. The biggest one by far. If recurring evidence was never collected, it cannot be produced afterwards, and the choice becomes an exception in the report or a restarted window.
2. Slow evidence handover during fieldwork. Auditors work in request-and-wait cycles. A week to answer each round turns three weeks of fieldwork into eight, and the auditor bills the difference.
3. Nobody owning it. Compliance loses every prioritisation call against shipping unless one named person is accountable.
4. Scope creep. Adding Availability or Confidentiality mid-flight widens testing and pushes dates.
5. Auditor availability. Firms are seasonal. Q4 and Q1 are busy, and a firm may not be able to start fieldwork the week you become ready.

How to compress it honestly

You cannot shorten the window, but you can stop wasting the months around it:

• Start collecting evidence on day one, before policies are finished. Access reviews and offboarding records only accumulate forwards.
• Run readiness and scoping in parallel. Quotes take weeks; do not wait for them to start enforcing MFA.
• Book the auditor early so fieldwork begins when the window closes rather than a month later.
• Have the evidence organised before fieldwork — dated, labelled, mapped to requirements. This is where weeks are won or lost.
• Ask whether a Type 1 unblocks the deal while the Type 2 window runs. Sometimes it does, and that is the only legitimate way to give a customer something in month three.

What to tell a customer who is waiting

Be specific rather than optimistic. "Our Type 2 observation window opens in March and closes in June, with the report expected in July" is credible and checkable. "We're working on SOC 2" is what everybody says and buys you nothing.

If the deal genuinely cannot wait, the usual instruments are a completed security questionnaire, your policy set, a penetration test result, and a Type 1 as an interim. Most enterprise buyers have a process for exactly this, and asking is free.

Questions people ask

How long does SOC 2 take?

A Type 1 report typically takes two to four months from a standing start. A first Type 2 report takes six to nine months with a three-month observation window, or fourteen to eighteen months with a twelve-month window. Roughly one to three months of that is readiness work; the observation window is calendar time that cannot be compressed.

Can you get SOC 2 in 30 days?

Not a Type 2, because the observation window alone is three to twelve months of calendar time. A Type 1 in thirty days is only realistic if the controls already operate and the policies are already approved, leaving just fieldwork. Claims of a compliant report in weeks generally refer to readiness tooling, not to an issued auditor's opinion.

How long is the SOC 2 observation period?

Three months is typical for a first Type 2 report. Subsequent reports usually move to six or twelve months so that coverage is continuous from one year to the next.

What delays a SOC 2 audit most?

Evidence that has to be reconstructed. Recurring artefacts such as quarterly access reviews cannot be created after the fact, so a gap becomes either an exception in the report or a restarted observation window. The second most common delay is slow evidence handover during fieldwork, which stretches weeks into months and increases the fee.

Should I start SOC 2 before a customer asks?

If you sell to enterprises, yes. The observation window is the one part of the process money cannot shorten, so the cost of starting early is small and the cost of starting late is a deal you cannot close for six months.