PW-SOC2-011
Starting SOC 2 Type 2 after Type 1 (observation window handoff)
How to enter the Type 2 observation window after Type 1 without dropping weekly evidence rhythm.
PW-SOC2-004 SOC 2 readiness spoke · Decide · side path
How long a first SOC 2 takes (Type 1 & Type 2)
TL;DR. A disciplined seed team often reaches a Type 1 report in about 2–4 months from serious kickoff. Type 2 adds an observation window—commonly 3–12 months—plus fieldwork. Buyer deadlines, not auditor marketing slides, should set your critical path.
Claim ladder Material statements on this page are labeled Verified, Inferred, or Unknown per editorial standards.
Key terms: observation window, Type 1.
On this page
Type 1 calendar
From “we are serious” to report: often 8–16 weeks for a focused Security-only scope when MFA, ticketing, and cloud inventory already exist. Greenfield identity or chaotic vendors stretch that.
Type 2 calendar
Pick an observation window length you can defend. Three months can work for mature controls; six to twelve months is common. Fieldwork and report drafting add weeks after the window closes.
Critical path items
- Buyer contractual dates (these win).
- Auditor capacity—book early.
- Evidence gaps on identity and change management.
- Leadership attention during PBC season.
Marketing “SOC 2 in 2 weeks” claims usually assume you already operated like a compliant company. Plan from your actual backlog.
Questions founders ask
Why do vendors quote unrealistically short timelines?
They assume mature controls already exist.
How long should our first Type 2 window be?
Long enough to show stable operation; often 3–12 months—confirm with auditor and buyers.
What delays fieldwork most?
Incomplete PBC responses and unclear system boundaries.
Sources
Cost and timeline figures on this site are educational planning ranges, not quotes from AICPA, CSA, Shared Assessments, or any auditor.
- primary SOC 2 — SOC for Service Organizations: Trust Services Criteria — AICPA & CIMA — Official SOC 2 topic landing; defines SOC 2 as examination of controls relevant to TSC categories.
- practitioner ProofWindow educational planning ranges — ProofWindow Editorial — Internal: cost/timeline bands are editorial planning language, not a surveyed dataset. Label Unknown for hard dollars; never attribute invented figures to AICPA/CSA/SA.
Linear path
← Path: SOC 2 Type 1 vs Type 2 for seed startups
Next in path: 90-day SOC 2 Type 1 checklist for SaaS founders →