SOC 2 timeline: how long does it take?
Last checked: 2026-10-16
Type 1 checks control design at a point in time; Type 2 checks operating effectiveness over an observation period (commonly 3–12 months). Sources give overlapping but different totals.
| Phase | Typical duration (third-party estimates) |
|---|---|
| Readiness / prep | 1–3 months (Drata); 4–12 weeks (SOC2Auditors.io) |
| Observation period (Type 2 only) | 3–12 months |
| Auditor fieldwork | 2–5 weeks (Drata); 2–6 weeks (SOC2Auditors.io) |
| Report delivery | 2–6 weeks (Drata); 2–4 weeks (SOC2Auditors.io) |
| Total, Type 1 | About 2–6 months depending on source |
| Total, first Type 2 | About 6–15 months |
Ranges vary by source and company. The AICPA doesn't prescribe a universal minimum observation period per one cited source. unverified
What speeds it up
- Controls already in place before kickoff.
- Narrow scope.
- Automated evidence collection via a compliance platform.
- Choosing the auditor early.