How Long Does SOC 2 Take, Start to Finish?

From a standing start, plan on 6 to 15 months to a first SOC 2 Type II report and 3 to 6 months to a Type I. Those are the bands this site already publishes: the end-to-end figure in our SOC 2 guide for startups, the Type I and kickoff-to-report figures in our ISO 27001 and SOC 2 comparison. We sell SOC 2 readiness work, so treat them as an interested party's numbers and check them against the engagement letter your own auditor actually sends. Here is the part that gets left out of every timeline graphic: your date is not set by the auditor's calendar, and it is not set by the length of observation window you choose. It is set by the least frequent control in your scope, because a Type II opinion is reached by sampling a period, and a control that runs once a quarter offers two samples in six months.

Below: where the months actually go, why the sampling arithmetic puts a floor under any honest schedule, the drift between "we are ready" and "the window is open" that quietly costs a quarter, the two levers that genuinely compress a timeline, and the case for a longer window than the one you want to buy.

Key takeaways

• Six to fifteen months end to end is the band for a first Type II from a cold start. Six to twelve months from kickoff is the band for a company whose controls already largely operate, and the difference between those two numbers is remediation.
• A Type I is a design opinion as of a date, so it lands in weeks once remediation is finished. A Type II is a period opinion, so it cannot land until a period has been lived through.
• The floor is a sampling floor. Auditors test operating effectiveness by pulling occurrences of a control from across the window, and a quarterly or annual control simply does not produce enough occurrences in a short window to support an opinion.
• The commonest cause of a slipped date is not remediation running long. It is the gap between finishing remediation and formally opening the observation window, because a Type I in hand removes the urgency.
• The two things that actually compress the calendar are a narrower scope and controls you already run. Paying more does not compress it, and neither does a different auditor.

The four phases, and where the months actually go

The AICPA promulgates the professional standards for SOC engagements and the examination is performed by a CPA firm, which means the shape of the work is fixed even though the durations are not. Four phases, in order.

Readiness, 2 to 4 weeks. Somebody maps what you do against the Trust Services Criteria you have selected and produces a gap list. This is the cheapest phase and the one most worth doing slowly, because everything downstream is scheduled off its output. If you are still deciding whether you need it at all, our piece on readiness assessments is the argument in both directions.

Remediation, 8 to 12 weeks. The gap list becomes engineering and process work: separating production access from developer convenience, standing up an access review that a human actually performs, fixing a deploy pipeline so that approvals exist as records rather than as culture. This is the phase with the widest variance, and it is the entire difference between the 6-to-12-month band and the 6-to-15-month one.

The observation window, typically 6 months for a first report and 12 for each annual cycle after. Windows in the market run anywhere from 3 to 12 months. Most first-time reports use six. Nothing in the professional standards fixes a minimum, a point our Type I versus Type II guide makes at length, which is precisely why the choice gets sold to you as a lever and precisely why it is a worse lever than it looks.

Fieldwork and issuance, 4 to 8 weeks. The auditor requests evidence, samples it, asks follow-up questions, drafts, and issues. Elapsed time here is mostly your response latency plus the firm's report review queue, not testing hours.

Add the midpoints from a cold start and you land near ten or eleven months. Add a scope you keep reopening and you land at fifteen.

The constraint that sets your date is sampling, not scheduling

Here is the arithmetic nobody puts on a pricing page.

A Type II opinion covers whether controls operated effectively throughout a period. The auditor does not watch the period; the auditor samples it. How audit sampling works covers the mechanics, and the consequence for your calendar is direct: the number of occurrences a control produces inside your window determines whether that control can be tested at all.

Walk it through. A control that runs on every deploy produces hundreds of occurrences in a quarter, so it is testable almost immediately. A monthly access review produces six occurrences in a six-month window, which is a workable population. A quarterly vendor review produces two. An annual penetration test, an annual risk assessment, an annual disaster recovery exercise and an annual policy review each produce exactly one, and one occurrence inside the window is the difference between an opinion and an exception.

So the honest way to set your date is not to ask how short a window your auditor will accept. It is to list every control in your scope by frequency, find the slowest one, and ask whether the window you are contemplating contains enough of it to test. If your scope includes an annual control that has never once been performed, no window length fixes that. You perform the control, and then the window can start.

This is also why "can we do three months" is usually the wrong question. It is answerable, and the answer sometimes is yes. But the report that comes out of a three-month window covers three months, and the sophisticated buyer reading it can see that, which brings us to the section that costs us money.

The drift that quietly costs a quarter

In our experience the commonest reason a SOC 2 date slips is not that remediation ran long. It is the interval between finishing remediation and formally opening the observation window.

The mechanism is banal. Remediation finishes in September. Everyone is tired. The auditor issues a Type I as of a date in October, sales has something to hand prospects, the pressure comes off, and the observation window does not formally open until January because nothing forced the issue. You have not lost three months of work; you have lost three months of clock, which is worse, because clock is the one input you cannot buy.

The fix is procedural rather than technical. Pick the window start date before remediation finishes and put it in the engagement letter. Then the Type I gets issued from inside the window rather than instead of it, which is the sequencing our Type I versus Type II guide argues for in full, and the clock is already running while the report circulates.

What actually compresses the calendar

A narrower scope. Fewer systems, fewer Trust Services Categories, fewer people. Security is the mandatory category; Availability, Confidentiality, Processing Integrity and Privacy are elective, and every one you add brings its own controls, its own evidence, and its own slowest control. Scope is decided in month one and it governs everything after.

Controls you already operate. A company arriving with disciplined offboarding, a real access review history and change approvals that already exist as records is buying an audit. A company arriving without them is buying a security program build and an audit, and the second bill is bigger in both money and months. If you already hold an ISO 27001 certificate, the overlap is substantial and the practical effect on the calendar is larger than the control-mapping percentage suggests.

Deciding evidence ownership early. For each recurring control, name now which system is authoritative for its population, and export from that system rather than reconstructing from memory in month seven. This costs a day in month one and routinely saves weeks in fieldwork.

What does not compress it: paying more, switching auditors, or buying a compliance automation platform in month five. Platforms genuinely save hours in evidence collection and we recommend them in most engagements, but they do not shorten a period, and a period is what you are waiting for.

What reliably blows it

A scope that keeps reopening. Every renegotiation restarts the evidence question for whatever came into scope, and if what came into scope has a slow control, it can reset the window.

An observation window opened over aspirational controls. If the access review is still a plan and the offboarding checklist lives in one person's head, the window will faithfully record that. Exceptions in a first report are survivable, and our piece on failing SOC 2 explains why the vocabulary of failure does not apply here, but exceptions are also the thing you bought the report to avoid discussing with procurement.

Response latency in fieldwork. Auditors work in evidence request rounds. A team that answers in two days and a team that answers in two weeks experience the same fieldwork as three weeks and eleven weeks respectively.

Discovering an untested annual control in month five. See the sampling section. This is the one that genuinely moves a date by a quarter, and it is entirely preventable by listing your controls by frequency in month one.

The case for a longer window than you want, which costs us work

Now the argument against our own commercial interest, because the shortest engagement is the easiest one to sell.

We will scope a three-month window if a customer contract demands a report by a date and there is no other way to reach it. We will also tell you what you are buying. A report covering three months is a report covering three months. Every buyer sophisticated enough to have a vendor security team can read the period on the cover, and some of them apply an internal policy that a first Type II must cover at least six. The time you saved is then spent twice: once on the short report, once on the real one.

There is a second version of the same trade, and it cuts harder. If nobody in your pipeline has actually asked for a SOC 2 report in writing, the honest answer to "how long does it take" is that it takes as long as you want, because you should not be starting. We have talked founders out of engagements on exactly this basis. Go and read the vendor security requirements attached to your three largest open deals first. If none of them names an attestation report, the same budget and the same six months do more for you in real control work than in an examination nobody requested. Our cost breakdown carries the money side of the same argument.

And plan for the fact that this does not end. Your next observation window opens before you hold the first report, which is the whole subject of SOC 2 in year two. Teams that treat year one as a project rather than an operating rhythm meet the renewal with an evidence backlog and no time.

Where Top Floor fits

The work we are useful for is the front of the calendar, not the back. Scoping decisions, the frequency inventory that finds your slowest control before it finds you, and the evidence architecture that makes fieldwork short are SOC 2 readiness work. Where a company has no internal owner for the program, compliance as a service is the arrangement that carries it. Where the question is whether a proposed calendar is honest before you write it into a customer contract, that is audit and assurance advisory work, and it is worth doing before the date becomes a promise.

We do not issue the report. Only a CPA firm does that, and any consultancy that blurs the line between preparing you and opining on you is telling you something about its independence.

How to decide this week

Do three things in order, and you will have a real date by Friday.

First, pull the vendor security requirements from your three largest open deals and your biggest renewal, and find out whether any of them names a required report type and a date. That is your deadline, and if there isn't one, you do not have a project yet.

Second, list every control you intend to put in scope with the frequency it runs at, and sort by frequency ascending. Read the top of that list. Anything annual that has never been performed is your real critical path.

Third, work backwards: report date, minus 4 to 8 weeks for fieldwork and issuance, minus the window you can actually defend, minus 8 to 12 weeks of remediation. If the resulting start date is in the past, the conversation to have is with your customer about a Type I plus a committed Type II date, not with your auditor about a shorter window.

Frequently asked questions

Can a first SOC 2 Type II be done in three months?

Sometimes, and it is usually a false economy. Windows in the market run from 3 to 12 months and nothing in the professional standards fixes a minimum, so a three-month window can be arranged. Two things constrain it. Controls that run quarterly or annually may not produce enough occurrences inside three months to be tested, and buyers with a vendor security team can read the period on the report cover and some apply a six-month floor by policy. As of August 2026 six months remains the common choice for a first Type II and twelve for each annual cycle after.

How long does a SOC 2 Type I take?

3 to 6 months from kickoff to report assuming moderate readiness, which is the band our ISO 27001 and SOC 2 comparison publishes. Most of that is readiness and remediation. The examination itself is a design opinion as of a single date, so once remediation is genuinely finished the report follows in weeks. The efficient sequencing is to open the Type II observation window first and have the auditor issue the Type I as of a date inside it, so the Type I is a byproduct rather than a detour.

What is the single biggest driver of the timeline?

Your starting control maturity, expressed as remediation length. The 6-to-12-month band assumes controls already largely operate; the 6-to-15-month band assumes they do not, and the gap between the two is the 8 to 12 weeks of remediation plus whatever slow controls have to be performed for the first time before the window can open.

Does a compliance automation platform make it faster?

It makes evidence collection faster and it does not make the period shorter. Platforms are genuinely useful for continuous technical checks and for keeping evidence in one place, and we recommend them in most engagements. They cannot shorten an observation window, cannot create occurrences of a quarterly control that has not run, and cannot answer an auditor's follow-up question for you. Expect them to compress fieldwork, not the calendar.