Modernization
Engineering Practice3 min read
How long SOC 2 actually takes, and what the time is spent on
The audit is the short part. Here is where the months actually go, and which work you can start before choosing an auditor.
Working on something like this?
Get an estimateThe short version
- Type II requires an observation window. No amount of budget compresses elapsed time.
- Policies are the fast half. Closing technical gaps is where the effort actually is.
- Start collecting evidence before you engage an auditor — the window can begin sooner.
- No engineering vendor can certify you. Certification comes from a licensed audit firm.
SOC 2 arrives the same way for most companies: an enterprise buyer asks for the report, the deal pauses, and someone searches for how long it takes. The honest answer has two parts, and only one of them can be accelerated with money.
Type I and Type II are different products
The window is why the calendar, not the budget, sets the date. A Type II report covers a period during which your controls were observed operating. You cannot buy your way past that, which is the single most common surprise.
Where the readiness effort actually goes
1
Scoping
Which trust services criteria apply — security is mandatory, availability and confidentiality are common, privacy and processing integrity are chosen deliberately. Over-scoping here is the easiest way to add months you did not need.
2
Policy set
The genuinely fast half. Templated, adapted, approved. Uncomfortable to admit, but this is not what makes readiness slow.
3
Technical gap closing
Where the effort concentrates: access reviews, MFA coverage, logging and retention, encryption, vulnerability management, backup testing, and offboarding that actually removes access. Every one is engineering work, and it is roughly three times cheaper designed in than retrofitted.
4
Evidence automation
Continuous compliance tooling reduces the manual collection burden considerably. Worth doing early, because it also tells you which controls are failing before an auditor does.
5
The observation window
Controls running, evidence accumulating. The work here is operational discipline — an access review skipped in month two is an exception in the report.
6
Fieldwork and report
The auditor samples evidence, asks questions, and issues the report. Well-prepared organizations find this comparatively undramatic.
The gaps that take longest to close
- Access reviews — not the review itself, but discovering nobody knows who has access to what
- Offboarding — proving that departed staff and contractors lost access promptly, historically as well as going forward
- Logging and retention — often absent on exactly the systems auditors focus on
- Vendor management — collecting and reviewing sub-processor reports, which depends on other companies' timelines
- Backup restore testing — most organizations back up; considerably fewer have evidence of a tested restore
What it does not require
SOC 2 does not mandate a specific tool, cloud, or architecture. It asks whether your stated controls are appropriate and operating. Vendors selling a product as a route to compliance are selling evidence automation, which is genuinely useful and is not the same thing.
Our cybersecurity services page covers the readiness and remediation work, and enterprise cybersecurity goes into the questionnaire-and-procurement side specifically.
Working through this on a real project?
Tell us what you are building. You will get a scoped estimate and an architecture you own, not a capability deck.
Common questions
Readiness depends on how many technical gaps you are starting with, and the Type II observation window then runs on its own clock regardless of budget — commonly three months at the short end and up to a year. The practical implication is that if a deal depends on the report, starting readiness before the deal appears is worth more than any amount of urgency afterwards.
Sometimes. Type I is faster and demonstrates intent, which occasionally unblocks a specific deal, and the readiness work counts toward Type II either way. If no buyer is actively asking for an interim report, going straight to Type II avoids paying for two audits.
Follow your buyers. North American enterprise procurement asks for SOC 2 far more often; international and public-sector buyers lean toward ISO 27001. The underlying control work overlaps substantially, so doing one properly makes the second considerably cheaper.
They handle evidence collection and continuous monitoring well, which is real value. They do not close technical gaps — if MFA coverage is incomplete or access reviews have never happened, the tool reports that fact accurately and someone still has to do the engineering.