Timeline guide
How long does SOC 2 take?
Six to eight weeks from kickoff to audit-ready for an AWS-native startup, a few more weeks for the Type 1 examination and report, and then a three to twelve month observation window before a Type 2 can be issued. The readiness half is compressible. The observation window is not, and anyone who says otherwise is selling you a Type 1 under a different name.
The whole path, end to end
| Stage | Elapsed | What produces the delay |
|---|---|---|
| Readiness (scan, remediate, evidence, mock audit) | 6 to 8 weeks | Your engineers' capacity for application-level fixes |
| Type 1 fieldwork and report issuance | 2 to 4 weeks | Auditor scheduling and their internal review |
| Type 1 report in hand | ~10 to 12 weeks from kickoff | |
| Type 2 observation window | 3 to 12 months, commonly 3 to 6 for a first report | The standard. Not compressible |
| Type 2 fieldwork and report issuance | 3 to 6 weeks | Sampling across the window takes longer than a point-in-time exam |
| Type 2 report in hand | ~7 to 12 months from kickoff |
Get the Type 1 in hand and open the Type 2 window on the same day. The Type 1 unblocks the deal now, and the window is already running while your customer's security review proceeds. Most enterprise buyers accept a Type 1 plus a written, dated commitment to a Type 2. That is the standard shape of the answer, and it is worth asking your customer directly rather than assuming the strictest reading of their request.
The readiness weeks, one at a time
Weeks 1 to 2: scan and scope
You deploy a read-only IAM role from our template: scoped, external-ID protected, CloudTrail-logged, revocable by you at any time. We sweep the environment against all 35 controls, then interview you on the process side, because no scanner can tell whether you actually ran last quarter's access review.
Two inventories get built here that shape everything downstream: your critical tools (every non-AWS system touching customer data or production) and your commitments (uptime SLAs and confidentiality clauses in your signed contracts, which determine whether Availability and Confidentiality are in scope). Output: a prioritized gap report and a fixed price.
Weeks 2 to 6: remediate
Two tracks run in parallel, which is the only reason six weeks is possible.
- What we deploy. The security baseline goes in as CloudFormation, in its own stack, alongside your infrastructure and never inside it: organization CloudTrail to a central archive, GuardDuty with a delegated administrator, AWS Config rules, S3 public access block, encryption defaults, VPC flow logs, alert routing, backup plans. This is days of work, not weeks.
- What your engineers do. Application-level fixes arrive as exact-fix tickets: the specific IAM policy, the specific security group rule, the specific endpoint. We verify each one by rescan. This track is the schedule, because it competes with your roadmap.
The policy program is written in the same window: 20+ policies describing how your team actually operates, not a template pack you will fail against later.
Weeks 5 to 7: collect evidence
Every control gets mapped to its artifact, collected, and organized to the auditor's request list before they ask for it. Doing this before fieldwork rather than during it is the single largest determinant of how long fieldwork takes. See the evidence checklist for what the list actually contains.
Week 8 and beyond: mock audit and hand-off
A rehearsed walkthrough, led by you and questioned by us, in the format the auditor will use. Then the introduction to an independent CPA firm, and support through fieldwork so their questions do not land on your roadmap.
The five things that actually cause slips
- IAM changes that need a deploy. A wildcard policy your application depends on cannot be tightened in the console. It is a code change, a test, a deploy, and a rescan. This is the most common cause of a slipped date, and it is the reason we ticket it in week two rather than week six.
- Encryption retrofits. Turning on default encryption is instant and covers everything created afterwards. Encrypting an existing RDS instance is a snapshot, copy, restore, and cutover, which means a maintenance window and a rollback plan. If we find one at the scan, it goes in the plan immediately.
- Policy approvals waiting on a person. Twenty-plus policies need a named approver. If that person is raising a round or on the road, the whole governance group stalls. Book the approval session in week one.
- Process evidence that does not exist. A quarterly access review you never ran cannot be produced retroactively. For a Type 1 you can start clean. For a Type 2 the gap is permanent for that window.
- Auditor scheduling. The only one outside your control. Good small firms book out weeks in advance, and holiday and busy-season periods are worse. Pick your auditor before you finish remediating, not after.
Choosing your observation window
The window is the period a Type 2 covers. You choose its length, within what your customers will accept.
| Window | Best for | Trade-off |
|---|---|---|
| 3 months | A first Type 2 with a customer deadline | Some enterprise buyers consider it thin, and one missed quarterly review is proportionally much worse |
| 6 months | The common first-Type-2 choice | Long enough to be credible, short enough to be reachable |
| 12 months | Steady state, once you are on an annual cycle | Every process control must hold for a full year with no gaps |
Most startups run three or six months for the first Type 2 and then move to a rolling twelve-month cycle. The important thing is that from the day the window opens, every control you wrote down has to actually run on its stated cadence. That is what the Type 2 Window Package exists to carry.
Working backwards from a customer deadline
Take the date the customer needs a report and subtract:
- For a Type 1: 2 to 4 weeks of fieldwork and issuance, plus 6 to 8 weeks of readiness, plus a 4-week buffer. Start at least three months out.
- For a Type 2: all of the above, plus your chosen observation window. Start at least six to nine months out for a three to six month window.
If the deadline is already inside that, do not fake it. Go back to the customer with a Type 1 date and a written Type 2 commitment. In our experience the request is usually softer than the first email implied, and a specific credible plan lands better than a vague fast promise.
Frequently asked questions
How long does SOC 2 take?
Six to eight weeks from kickoff to audit-ready for an AWS-native startup, then two to four weeks for the Type 1 examination and report. A Type 2 needs an observation window of three to twelve months on top of that, most commonly three to six months for a first report.
What is the fastest you can get SOC 2?
A Type 1 report roughly ten to twelve weeks from kickoff for a clean AWS environment. Nothing legitimate compresses a Type 2 below its observation window, because the auditor tests evidence spanning that period. A provider promising a Type 2 in weeks is describing a Type 1.
Can we run readiness and the observation window at the same time?
No, and it is worth understanding why. The window tests whether controls operated effectively over a period. Controls you are still building did not operate. Opening the window before controls are in place guarantees exceptions across the early months. Get the Type 1, then open the window.
Does a compliance platform make it faster?
It makes evidence collection and monitoring faster, which is real. It does not make remediation faster, and remediation is what the six to eight weeks is spent on. Teams that buy a platform and no engineering help commonly spend three to six months, not because the tool is bad but because the work it surfaces still has to be done by someone.
What if our environment turns out to be complex?
We tell you at the gap assessment rather than in week five. Seventeen or more failing controls, or an encryption retrofit, or an account restructure, means the honest answer is a phased plan with a longer timeline and an individually scoped price. Forcing that into a standard window is how engagements fail.
Find out what your timeline actually is
The $2,500 gap assessment scans your environment against all 35 controls and returns a prioritized gap report with a fixed quote and a real date. Credited in full toward the engagement.
Book a 30-minute scoping callScoping call this week, scan within the next.