How long a SOC 2 actually takes

Most timeline pages in this market are written to end in a demo booking, so they answer in vague phases and never in dates. That is the wrong shape of answer. You have a contract paused on a security review, a procurement contact waiting on an email, and a need to say something specific by Friday. Every phase below carries the duration it actually takes.

The Type 1 path, phase by phase

Five phases. Four of them belong to you and only the last one belongs to the auditor, which is the opposite of what most founders assume. The calendar is yours to move.

The afternoon estimate for intake is real, and intake is the phase people over-prepare for. You are describing what you already do. Nothing is being graded yet. An answer that turns out to be optimistic comes back as a gap with a remediation task attached, which is the point of running a deterministic gap engine over your responses instead of a consultant interview. The integrations then pull the evidence that exists in your infrastructure already, so the upload queue is shorter than you expect.

What actually pushes the date out

None of the phases above is what makes a SOC 2 slip. The delays are boring, and they are almost always external. Four causes account for most of them, and you can start all four on the morning you begin.

A penetration test nobody has booked

SOC 2 does not mandate one,¹ but auditors and enterprise buyers routinely expect a recent test in the package. Good firms book weeks out. If your scope calls for one and it is not scheduled, that is your critical path, not the questionnaire.

A vendor who will not return a security questionnaire

A vendor whose own controls you depend on to meet your commitments is a subservice organization, and the report has to say whether you carved its controls out or included them.² Large providers publish what you need. Small providers frequently go quiet, and chasing one can take longer than every other open item combined.

Engineering time you cannot get

A handful of gaps need somebody with production access for an afternoon: log retention, an access review, a restore test. Book that afternoon on day one. A remediation list waiting on an unscheduled engineer is the most common reason a two week Type 1 becomes a six week one.

Controls that need real infrastructure changes

Enforcing multi-factor authentication across every account, centralizing logs, moving secrets out of a repository. These are not writing tasks, and no amount of policy drafting substitutes for them.

The pattern holds every time. Anything you can write takes hours. Anything that depends on another company takes weeks. Sort your remediation list by who has to act rather than by control number, start the external items immediately, and do the documentation while you wait on them.

Type 2 runs on a clock nobody can compress

Type 1 asks whether your controls were designed properly as of a single date. Type 2 asks whether they actually operated across a period.³ That one difference is the entire timeline argument, because a control has to exist, fire, and leave a trace before anybody can test whether it worked. Being organized does not speed that up. Only the calendar does.

Why the window is a real floor

Three months of access reviews, change tickets, incident records and vulnerability scans is what the auditor samples from. Shorten the period and there is nothing to sample. A longer window is a longer wait, so settle the length in writing before you sign an engagement letter rather than discovering it afterwards.

What the window costs while it runs

The subscription through the window is $600 per month on a 12-month term, and each examination is $5,000, including your first. Type 1 itself is $4,000 one time, with the first examination and the auditor engagement fee inside that number rather than arriving later as a separate invoice. The full breakdown is on what SOC 2 actually costs.

Type 1 first. Always.

Even when the buyer wrote Type 2 in the email. You cannot begin an observation window before the controls exist, so the fastest route to a Type 2 report runs through the Type 1 anyway. The Type 1 lands in weeks, it unblocks most security reviews on its own, and the clock on your observation window starts the same day rather than three months from now. Type 1 versus Type 2 covers how to read the request and work out which one your buyer actually needs.

The date you can safely promise

Deals stall in silence, not in delay. Name the phase, give a date at the far end of your estimate, and never commit to a date the auditor controls. Report issuance is the auditor’s call. Commit to the package delivery date instead. What to say to a customer mid-audit covers the full script.

The one variable that moves everything

Every date on this page assumes somebody owns it. A SOC 2 that belongs to the whole company takes months, because each open question waits a day for the right person to notice it. The same SOC 2 with one named owner who blocks two afternoons and answers the auditor within a day takes weeks. That is most of the difference between the timelines founders report to each other. The auditor is rarely the bottleneck. You are, which is the half of the schedule you can still fix. If you want the mechanics before you commit to a date, how the flow runs walks through it end to end.