A first SOC 2 Type 2 report usually takes roughly six to fifteen months from the start of preparation to the report in hand. Readiness, getting controls designed and running, takes from a few weeks to several months depending on where you start. The review period, the window over which the auditor tests that controls operated, is commonly three to twelve months for a first report. Fieldwork and issuance then add several weeks after the period ends. A Type 1 is faster because it covers a single date, so there is no review period to wait through.
"How long does SOC 2 take?" has a precise answer for one part of the process and an honest range for the rest. The review period is a calendar fact you agree with your auditor. Everything before it depends on your starting point, and everything after it depends mostly on how quickly evidence reaches the auditor.
The phases and how long each takes
| Phase | What happens | Typical length | What moves it |
|---|---|---|---|
| Scoping | Choose the system in scope, the Trust Services Criteria categories and the report type; select an auditor | A few weeks | How clearly the product and its infrastructure boundaries are defined |
| Readiness | Gap assessment, policies written and approved, missing controls implemented and running | A few weeks to several months | Existing security practice, engineering capacity and the number of missing controls |
| Type 1 (optional) | The auditor tests the design of controls as at a date | A few weeks of fieldwork | How ready the evidence is on the day |
| Review period | Controls operate and evidence accumulates; the auditor will sample from the whole window | Commonly three to twelve months; often three to six for a first report | What your customers accept, and when the period starts |
| Fieldwork | The auditor samples evidence across the period and interviews control owners | A few weeks, often overlapping the end of the period | How quickly evidence requests are answered |
| Report issuance | Draft report, management responses to any exceptions, final report | A few weeks after fieldwork | The number of exceptions to explain and the review cycles |
Three example schedules
- Starting from little, straight to Type 2: around three to four months of readiness, a three-month review period, then about a month of fieldwork and issuance. Roughly eight months to the first report.
- Starting from little, Type 1 first: the Type 1 arrives at the end of readiness, around four to five months in, and the Type 2 follows a full review period and issuance after that. Two reports and two engagements, but something to show buyers sooner.
- An established security programme: readiness shrinks to a few weeks of closing gaps and collecting evidence, so the review period dominates the timeline.
The Type I versus Type II comparison covers when the Type 1 detour is worth it.
When the review period can start
The review period should start once the controls in scope are designed and operating, because the auditor tests whether each one ran across the whole window. A control introduced halfway through either produces an exception for the months it was missing or has to be carved out of the report. Agree the start date with your auditor in writing, and treat it as the date by which readiness has to be finished.
What slows audits down
- Evidence collected by hand, as screenshots, when the auditor asks for it rather than as the control runs.
- A scope that keeps moving: new products, regions or infrastructure added during the period.
- Controls that run only quarterly or annually, where one missed occurrence is an exception with no later sample to show it was fixed.
- Slow answers to the auditor's evidence requests during fieldwork.
- Missing reports from subservice organizations such as your cloud provider, which the auditor will ask for.
After the first report
Most companies move to a twelve-month review period after the first report, with each period starting the day after the last one ended. The report for each period is issued some weeks after it closes, and a bridge letter covers the time in between for customers who ask. From then on the timeline is a yearly cycle rather than a project, and the work moves from building controls to keeping them running.