SOC 2 · Timeline
SOC 2 timeline: what actually happens, week by week.
A first-time SOC 2 Type II runs six to twelve months end-to-end. We publish the timeline in weeks, not phases, so your commercial team can commit to buyer conversations with confidence.
01 — Overview
SOC 2 timelines slip for predictable reasons: undefined system boundary, late auditor selection, shadow environments discovered mid-engagement, and vendor evidence collected reactively. We eliminate each in the first two weeks of the program.
02 — Engagement
Our approach.
- I
Weeks 1 – 6
Scoping, TSC election, readiness assessment, and auditor selection.
- II
Weeks 7 – 14
Control remediation, policy suite, and evidence instrumentation.
- III
Observation
Three, six, or twelve months of monitored control operation with monthly reviews.
- IV
Final 6 – 8 weeks
Auditor fieldwork, sample selection, evidence review, management assertion, and report issuance.
03 — Deliverables
What you receive.
- Week-by-week engagement plan with commercial milestones
- Auditor selection and kickoff by week six
- Monthly steering committee reports across the observation window
- Signed report by the committed date
04 — Timeline
Expected duration.
The commitment we make is a signed report by a specific date. That commitment sits in every engagement letter we write.
Ready to begin?
A partner-led readiness call is complimentary. We'll scope your engagement inside forty-five minutes.
Schedule the call →05 — FAQ
Common questions.
Can we compress the observation window?+
You can elect a three-month window for a first-time Type II. Enterprise buyers increasingly expect six or twelve. We help you choose the window that matches the buyer conversations already in motion.
What happens if we discover a control gap during observation?+
We correct it, document the corrective action, and disclose it in the system description if material. Correcting a gap during observation is expected; concealing one is not.