"How long will SOC 2 take?" is the second question every prospect asks, right after the price. The honest answer is a range: 6 to 12 weeks to a Type 1 report for a small, well-organised SaaS company, and 6 to 15 months to a first Type 2. Below is where that time actually goes, what shortens it and what stretches it.
The four phases of a SOC 2 project
Every SOC 2 timeline is made of the same four blocks, whatever the vendor tells you:
- Scoping (1–2 weeks): which systems, which Trust Services Criteria, which locations and which subservice organisations (AWS, Azure, GCP, payroll providers) are in or out.
- Readiness (4–10 weeks): gap analysis, writing or fixing policies, implementing missing controls, setting up evidence collection.
- Examination by the CPA firm (3–6 weeks for fieldwork, drafting and quality review).
- Observation period (Type 2 only): 3 to 12 months during which controls must operate and leave evidence.
Only the first two phases are under your direct control. The examination runs on the CPA firm's calendar, and the observation period is fixed once you choose it.
SOC 2 Type 1 timeline
A Type 1 report describes the design of your controls at a single date. There is no observation period, so the timeline is readiness plus examination.
| Week | What happens |
|---|---|
| 1–2 | Scoping call, system description draft, TSC selection, CPA firm quotes |
| 3–8 | Readiness: gap analysis, policies, access reviews, logging, vendor list, risk assessment |
| 9–10 | Internal readiness audit and fixes; evidence package frozen "as of" the report date |
| 11–14 | CPA examination: walkthroughs, document review, management representation letter, report |
Companies that already hold ISO 27001 typically cut readiness in half: most of the policies, the risk register and access-control evidence already exist and only need mapping to the criteria.
SOC 2 Type 2 timeline
A Type 2 report adds the observation period. The minimum most CPA firms accept is 3 months; the market standard for customer due diligence is 6 or 12 months. Add 4–8 weeks after the period ends for the examination.
| Route | Readiness | Observation | Examination | Total |
|---|---|---|---|---|
| Type 1 first, then Type 2 (3 months) | 8 weeks | 3 months | 6 weeks | ≈ 7 months |
| Straight to Type 2 (6 months) | 8 weeks | 6 months | 6 weeks | ≈ 9–10 months |
| Straight to Type 2 (12 months) | 8 weeks | 12 months | 6 weeks | ≈ 15 months |
A short first observation period (3 months) gets you a Type 2 report quickly; the second report can then cover a full 12 months. This is the route we recommend to most companies with an enterprise deal waiting.
What makes SOC 2 take longer
- No single owner. Projects where "the CTO will handle it in the evenings" routinely take twice as long. Budget 4–6 hours a week from one named person.
- Undocumented infrastructure. If nobody can list all production accounts, admin users and third-party services, the first three weeks go into discovery.
- Controls that exist but leave no evidence. Code review happens, but there is no branch protection; access is reviewed, but nothing is signed. The observation period cannot start until evidence is being produced.
- Late CPA engagement. Good CPA firms schedule fieldwork weeks ahead. Engage the firm during readiness, not after.
- Scope creep. Adding Availability and Confidentiality criteria halfway through resets part of the work.
What makes SOC 2 faster
- Existing ISO 27001 or Cyber Essentials Plus certification.
- Cloud-native infrastructure on AWS, Azure or GCP with infrastructure-as-code and central identity (SSO, MFA everywhere).
- A compliance platform (Vanta, Drata, Secureframe, Sprinto) connected from week one, so evidence collects itself during the observation period.
- Starting with the Security criterion only and adding others in the next cycle.
- A readiness partner who has run the exercise before and a CPA firm engaged early with a fixed fee.
How BALTUM plans the calendar
We put the whole calendar on one page in week one: readiness milestones, the "as of" date for Type 1, the start and end of the observation period, CPA fieldwork dates and the expected report date. BALTUM runs the readiness and the internal audit; the examination and the report are performed by an independent, licensed US CPA firm under a direct engagement letter with your company. Ask us for a fixed-fee quote and we will return a dated plan with it.