How long does SOC 2 take? For a Type 1 report, most SaaS companies are looking at 3 to 5 months from kickoff to report in hand. For a Type 2 report, add the observation period itself — typically 6 to 12 months of your controls actually running — on top of the readiness work, which puts most companies at 9 to 15 months total if they're starting from zero. Anyone who gives you a single number without asking which report you need is guessing.
Why "how long" is the wrong first question
The question founders actually need answered isn't "how long does SOC 2 take" — it's "how long does which SOC 2 take." A Type 1 report and a Type 2 report are evaluated completely differently, and that difference drives the entire timeline.
A Type 1 report is a snapshot. The auditor looks at your controls on a single date and confirms they're designed correctly. A Type 2 report covers a window of time — usually 6 to 12 months — and the auditor samples evidence from throughout that window to confirm the controls didn't just exist, they actually ran, consistently, week after week. You can compress a Type 1 timeline by working faster. You cannot compress a Type 2 observation period below about six months and still have a credible report, because the entire point of a Type 2 is proving duration.
Most companies pursuing their first SOC 2 start with Type 1 to get a report in enterprise prospects' hands faster, then begin the Type 2 observation period immediately afterward. For more on how that transition works and what evidence auditors sample during it, see our guide to what a SOC report actually is.
Month-by-month: what actually happens
Strip away the marketing language and a SOC 2 project breaks down into four phases, regardless of who's running it.
- Readiness and gap assessment (weeks 1–4): Someone reviews your current environment — cloud setup, access controls, policies you already have (or don't) — against the Trust Services Criteria and produces a list of what's missing. This is also when you decide scope: which systems, which criteria, Type 1 or Type 2 first.
- Policy writing and control implementation (weeks 3–8, overlapping with readiness): Policies get written, MFA gets enforced where it was optional, access reviews get scheduled, logging gets turned on where it was off. This is the phase with the most variance — a company with decent hygiene already might spend three weeks here; a company with shared admin logins and no access inventory might spend eight.
- Evidence collection and the audit window (weeks 9–16 for Type 1; months 2–14 for Type 2): For a Type 1, this is a few weeks of pulling together screenshots, configs, and documentation for the auditor to review. For a Type 2, this is the observation period itself — the long middle where you run your controls and collect evidence continuously, not in a sprint at the end.
- Audit fieldwork and report issuance (3–5 weeks): Your CPA firm reviews the evidence, asks follow-up questions, and issues the report. This stage is largely out of your hands — it depends on your auditor's calendar and how clean your evidence is.
What speeds a timeline up — and what slows it down
The single biggest lever is scope. A tight scope — your production infrastructure and the systems customers actually touch — moves faster than a scope that includes every internal tool, staging environment, and legacy system you've accumulated. Add a second Trust Services Criterion (Availability, Confidentiality) beyond the required Security criterion, and you add evidence requirements that take real time to satisfy.
The second lever is how clean your access control story is before you start. Shared admin accounts, former employees with lingering credentials, and inconsistent MFA enforcement are the most common findings in a first-time audit — and each one is a cleanup task that eats weeks if it isn't already handled. Our guide to access control and least privilege walks through the six specific things auditors check here and roughly how long each takes to fix.
The third lever is whether evidence collection is automated or manual. Teams stitching together spreadsheets and screenshots lose time to auditor follow-up questions — every piece of missing or inconsistently formatted evidence is a round trip. Teams with automated evidence collection in place from day one avoid most of that back-and-forth. For a breakdown of which parts of this process can genuinely run on autopilot and which still need a person making a judgment call, see SOC 2 automation: what to automate and what still needs a human.
What doesn't speed things up, no matter how much pressure you apply: your auditor's calendar, and the Type 2 observation period itself. Both are fixed costs of time that no amount of internal effort shortens.
Realistic Type 1 timeline vs. realistic Type 2 timeline
| Phase | Type 1 | Type 2 |
|---|---|---|
| Readiness & gap assessment | 2–3 weeks | 2–3 weeks |
| Policy writing & control implementation | 6–8 weeks | 6–8 weeks |
| Observation / evidence window | N/A — point in time | 6–12 months |
| Audit fieldwork & report | 3–5 weeks | 3–5 weeks |
| Total | ~3–5 months | ~9–15 months from a cold start |
That Type 2 total looks long, but it's misleading if read in isolation. Most companies don't run the Type 2 clock from zero — they issue a Type 1 first, then start the Type 2 observation period immediately afterward, often sharing the Type 1 report with prospects while the Type 2 clock runs in the background. Done that way, you have something to show enterprise buyers within 4 to 5 months, and a Type 2 report within roughly a year of starting, not fifteen months of sequential waiting.
Why rushing the Type 2 observation window backfires
It's tempting, when a deal is stalled on SOC 2, to ask whether the observation period can just be shorter. It can — six months is the practical minimum — but shortening it has real costs. A shorter window gives your auditor fewer samples to pull from, which can mean more scrutiny per sample rather than less. It also gives your report a shorter shelf life: a 12-month observation period produces a report that ages more slowly in the eyes of a buyer than a 6-month one.
The deeper problem with rushing is that a Type 2 is measuring consistency, not existence. If you turn on MFA enforcement two weeks before the observation period starts, that's fine — the control was in place for the whole window. But if you're still writing your access review process in month 4 of a 6-month window, the auditor has fewer months of evidence that the control actually ran, and that's exactly the kind of gap that shows up as a finding. Rushing the setup to protect the clock just moves the risk from "we started late" to "we have thin evidence."
What a 4–6 month done-for-you engagement looks like week by week
SocBridge runs SOC 2 Type 1 engagements on a 4-month timeline and Type 2 engagements on a 6-month timeline, with the same four-phase structure described above compressed by having a dedicated team run it rather than a founder squeezing it between other work.
- Weeks 1–2: A CISSP-certified compliance specialist assesses your current setup, identifies gaps, and builds the plan. You don't prepare anything in advance — this is a review of what already exists.
- Weeks 3–8: Policies get written for your specific business, and cloud-certified architects implement the technical controls your stack needs — logging, access controls, encryption settings. You review and approve; the implementation work happens on the delivery side.
- Weeks 9–16: The audit runs. You choose your independent CPA firm; SocBridge briefs them, collects the evidence they need, and handles the follow-up questions so they don't land on your desk.
- Month 4–6 onward: You get your report. For Type 2 engagements, the observation period and evidence collection continue to run on the IronFort platform, with continuous monitoring afterward so the next renewal isn't a scramble.
The variable that moves this timeline the most on the customer side is simply how quickly your team reviews and signs off on things — the compliance work itself is scoped and run by the delivery team, not stacked on top of your engineering backlog. If you want a sense of what's actually involved in the access control cleanup that tends to eat the most time in a DIY timeline, that's worth reading before your first call.