How long is a SOC 2 report valid? The 12-month convention

Updated 25 October 2026

A SOC 2 report has no formal expiration date. A Type II report covers a stated period, a Type I report covers a single date, and each customer decides how recent a report it will accept. The common convention is about twelve months, so many companies renew every year and run their observation periods back to back. Even then there is a gap between the end of one report's period and the issue of the next report, and a bridge letter covers it. This guide covers the 12-month convention, the point where the sources disagree on when the count starts, and how to plan renewals so one report follows the last.

The short answer: no expiry date, but buyers expect a recent report

Secureframe puts it plainly: "Technically, SOC 2 reports don't expire" (Secureframe). It adds that customers could reject a report as outdated if too much time has passed, and that most service organizations renew every year. Compass IT Compliance and TCSA say the same thing in their own words (Compass) (TCSA). TCSA calls the twelve months a market convention and not a rule.

That fits what a SOC 2 report is. It is an attestation report from a CPA firm about a system, for a stated period or date, not a certificate with a term (see is SOC 2 a certification?). The report does not become wrong a year later. It becomes older evidence, and the reader decides how much weight old evidence gets. Customers want to know how your controls perform now, which Secureframe gives as the reason they ask for a recent report.

The 12-month convention, and the date it counts from

Every source read for this page uses twelve months as the norm, or as the top of a range. They disagree on the starting point, and that matters because a report is issued after its period ends. The report-age guidance for buyers sets out each source's rule for reviewing a vendor. This table covers only where each source starts the count:

So the sources split into an issue-date camp and a period-end camp, and the same firm appears in both. TCSA adds a rough ladder counted from period end: up to about three months is accepted without comment, three to six months may draw a question about whether the next examination has started, six to twelve months often brings a request for a bridge letter, and beyond twelve months buyers usually ask for the current report (TCSA). That ladder is one publisher's view, not a standard.

Here is why the starting point matters, using invented dates. Say a Type II period runs 1 January to 31 December 2026 and the report is issued on 15 February 2027, about six weeks after the period ends. Counted from period end, the twelve months run out on 31 December 2027. Counted from the issue date, they run out on 15 February 2028. A buyer in the period-end camp stops treating the report as current six weeks before a buyer in the issue-date camp does. You do not control which camp your customer is in, so ask.

Type I and Type II age differently

A Type I report covers the design of controls on one date. A Type II report covers design and operation over a period (see Type I vs Type II). Compass notes that a Type I report is a snapshot with no evidence that controls were followed over time, and that most organizations choose Type II because it fits the annual cycle (Compass). None of the sources read for this page gives Type I its own validity window, so treat the twelve-month talk as applying to whichever report you hold, and ask the customer if a Type I will do.

For a Type II report, the length of the period also matters. TCSA says a short first Type II, such as three months, ages faster, because readers weigh both how long ago testing stopped and how much testing was done (TCSA). Agency says a period should be sufficiently long, prefers six to twelve months and calls six months the minimum (Agency). How long your period should run is covered in the observation period guide.

The gap between two reports, and the bridge letter

Renewing on a yearly rhythm does not remove the gap. A new report cannot be issued until its period has ended, the fieldwork is done and the CPA firm has finished writing. Going on the same invented dates, the 2027 period ends on 31 December 2027, and its report arrives some weeks later. For those weeks the newest report you can hand a customer still ends on 31 December 2026. A buyer who counts from period end now sees a report that is just over a year old.

A bridge letter fills that gap. Compass says a report whose period ended more than six to twelve months ago needs a renewal report or a bridge letter covering the gap (Compass), and its 2024 article says you may be asked for one to cover the time since the last audit report (Compass). TCSA describes a letter that management writes and signs, not the CPA firm, with no audit assurance, confirming that nothing material has changed since the period ended (TCSA). Scrut and Agency do not mention bridge letters in the pieces read for this page.

• It is management's statement. Nobody at the CPA firm examines it. See the SOC 2 bridge letter template for what it should and should not say.
• Its reach is limited. TCSA says a letter works for roughly a quarter, and that customers generally want the next report when it would need to cover more than about three months or the underlying report is over a year old. The bridge letter page notes that no AICPA standard sets a limit and each customer decides.
• It does not replace the report. If the gap is long or the customer wants tested evidence, the answer is the next report, not a longer letter.

Plan renewals so one report follows the last

The point of planning is to keep the weeks without a fresh report short, and to know in advance how you will cover them. A workable order:

1. Start the next period the day after the last one ends. TCSA gives this advice so the periods abut and no month goes untested (TCSA). Agency notes that Type II reports are typically issued once a year and cover a twelve-month period (Agency).
2. Book the CPA firm early. Compass says the renewal process typically starts months before the old report ages out, without giving a number (Compass). Ask your firm for its fieldwork window and a target issue date, because the date the report lands decides the length of the gap. See how to choose a SOC 2 auditor if you have not yet picked one.
3. Ask your biggest customers their rule. Which date they count from and what age they accept decide when you need the new report or a letter. Write the answers down next to each contract renewal date.
4. Date the plan. The SOC 2 timeline planner turns your answers into a dated plan. Every duration in it is an assumption you can change, including the length of the observation period.
5. Keep operating the controls through the gap. The next period is already running while you wait for the last report, so keep the dated records from the observation period calendar. The annual policy review record is one of the once-a-year items to schedule.
6. Prepare the bridge letter before it is asked for. Fill in the CPA firm, the report period and a date, and keep the draft so you can reissue it with a new date if the gap stays open.

If you are the buyer, the same facts apply the other way: decide your own age limit, write down which date it counts from, and say whether you accept a bridge letter. The reading guide shows where to record it. If a customer is already asking and you hold no report yet, see what to send when a customer asks.

Where Policyseed fits

The free generator writes the 22 policies from 23 questions in your browser, with no signup, so the written controls an auditor reads at each renewal are ready to adopt. The bridge letter generator and the timeline planner are free too. The Audit Kit ($59, one time) adds an annual policy review record, a calendar file of review dates and a timeline draft built from your answers. None of it replaces the CPA firm, which writes the report and forms its own opinion.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.