SOC 2 observation period: length, start date and what to do in it

Updated 25 October 2026

The SOC 2 observation period is the window of time a Type II report covers. Its length is something you agree with your CPA firm, and sources commonly put it between 3 and 12 months. What has to happen during it is simple to state and easy to miss: every control runs on its stated schedule and leaves a dated record, so the auditor can sample from the whole window. This guide covers how to choose a length, when the window can start, a calendar of the recurring work your policies commit you to, and what follows once the window closes.

What the observation period is

A SOC 2 report is an attestation written by a licensed CPA firm. A Type I report speaks to the design of your controls on one date. A Type II report speaks to whether they operated over a period, and that period is the observation period, sometimes called the audit period or the review window. The firm does not take your word for it: Compass IT Compliance describes the firm collecting evidence such as logs, access records and incident response actions, and sampling and validating specific controls (Compass IT Compliance). Linford & Co gives one example of how a firm explains sampling: for a monthly control, the firm would select three months for testing (Linford & Co). How many samples a firm takes is its decision, so ask yours how it will test each control.

The practical consequence is the same whatever the sample size. Anything the auditor picks must have a record dated inside the window, and a missed instance is visible. See Type I vs Type II for how the two reports differ in what they ask of your policies.

3, 6 or 12 months

The sources do not agree on one number, and none of them can know your customers. Compass IT Compliance says observation periods typically range from 3 to 12 months. It calls 3 to 6 months ideal for first-time audits, where the aim is a Type II report sooner, and describes 9 to 12 months as giving more assurance and aligning with annual audit cycles. For later reports it recommends moving to a full 12-month period once the organization has shown it can keep operations consistent (Compass IT Compliance). Another practitioner guide gives a 3-month period for a first report and says evidence is collected across 3 to 12 months (freeCodeCamp). These are the publishers' views, not a rule in the criteria.

The factors that actually decide it:

• What the customer accepts. If a contract or security review names a minimum period, that sets your floor. Ask which period they will accept before you choose.
• How long your controls have been running. A longer window needs a longer stretch of unbroken records, so a control you started last month is a better fit for a short first window.
• What your CPA firm will report on. Firms set their own minimums, so confirm the shortest window they will take for a first report.
• When you need the report. The report comes after the window ends and fieldwork is done, so the window length is a floor under your timeline.

The SOC 2 timeline planner models 3, 6 and 12-month windows. Its durations are planning assumptions that you can change, and it does not recommend one length. It starts the window the day after the readiness review is complete and assumes three weeks of fieldwork for a Type II report. Your firm's real dates replace those assumptions once you have them. The plan can be downloaded as Excel or as a calendar file.

When the window can start

Start the window when your controls are in place and operating, not when you begin building them. Compass IT Compliance says the period should start only when controls are fully implemented and functioning, that for many organizations this is the day after a Type I examination is completed, and that an earlier start is possible if controls were already running and you can show consistent operation (Compass IT Compliance). The freeCodeCamp guide warns that when a control is added late, the clock for that control restarts from the day it was implemented (freeCodeCamp). Treat both as one author's advice and settle the start date with your firm.

Before you start it, check four things:

1. The policies are approved and acknowledged (see the acknowledgment guide).
2. Every procedure that will be sampled has run at least once, so a first record exists.
3. Each recurring task has a named owner and a date in a calendar.
4. The start date is written into the engagement letter.

The readiness assessment and the gap assessment template show which controls are not yet running.

What to operate and record each month and quarter

Section 5 of each Policyseed policy describes how its controls run, with the owner and the cadence. The calendar below lists the recurring items from the templates by how often they fall due. The cadences are what the templates state by default for the sample company; if you edit a policy, the cadence you wrote is the one the auditor will hold you to, so keep this list in step with it. Write cadences you will meet.

Here is how six of those procedures read in the templates. These excerpts are rendered from the policy files for the sample company, so your own wording will differ once you answer the intake.

Quarterly access review (Access Control Policy, 5.3)

Quarterly access review. Within the first two weeks of each quarter the Security Owner exports user and role lists from Okta, the identity services of AWS and Vercel, GitHub, Supabase, Stripe, Datadog and Slack and production databases, reconciles them against the personnel list from People Operations, and sends each system owner their list for attestation. Owners respond within ten business days, removals are completed within five business days of the response, and the signed-off review is retained as evidence.

Monthly patch cycle (Vulnerability and Patch Management Policy, 5.4)

Monthly patch cycle. In the first week of each month Engineering updates base images, rebuilds and redeploys production services, applies pending updates to long-lived hosts, reviews the endpoint compliance report from Kandji and remediates or blocks non-compliant devices, producing a record of what was updated and any deferrals.

Quarterly restore test (Backup and Recovery Policy, 5.3)

Quarterly restore test. Each quarter Engineering restores a backup of at least one Tier 1 database and one storage bucket, no more than one day old, into an isolated environment, verifies row counts, checksums or sample records against production, measures elapsed time against the RTO, deletes the copy and files the test record for the Security Owner's review.

Quarterly risk review (Risk Assessment and Management Policy, 5.7)

Quarterly review. The Security Owner reviews every High and Critical risk with its owner, confirms progress, re-scores where circumstances have changed, chases overdue actions, checks acceptances expiring next quarter, reviews monitoring evidence and prepares the report required by 4.11.

Security training (Human Resources Security Policy, 5.4)

Security training. The Security Owner maintains the curriculum and assigns it to new starters within 30 days and to all personnel annually. People Operations chases incomplete training at 14 and 7 days before the deadline. Phishing simulations run at least twice a year; anyone who fails one completes a refresher within two weeks. Owner: Security Owner, with People Operations. Cadence: at hire and annually.

Annual vendor review (Vendor and Third-Party Risk Management Policy, 5.5)

Annual review. The Security Owner reviews every Tier 1 and Tier 2 vendor within twelve months of its last review, obtaining the updated assurance report, checking incident history and sub-processor changes, re-confirming tier and data with the business owner, recording outcomes and actions, and summarizing for Executive Management the vendors whose risk has increased.

An evidence calendar so nothing is missed

A control that ran but left no record looks, to an auditor, like a control that did not run. Three habits prevent most misses:

• Put every recurring task on a shared calendar with an owner, one entry per instance. The timeline planner can put its milestones in your calendar, and the Audit Kit includes a review calendar file ($59) for the policy reviews on the cadence you chose.
• Save the record the day you finish the task. A signed access review, a restore test record, a ticket, a dated screenshot: file it in a folder named for the quarter. The evidence checklist lists what each control usually leaves behind.
• Build the recurring artifacts from templates. The access review tool builds the workbook for each quarter's review, and the quarterly security report template collects the metrics your policies promise. The security awareness training pack gives you a completion tracker for the yearly training.

The planner adds the same items to a Type II plan: a quarterly access review in each quarter, and a risk register review, vendor review, incident response tabletop and backup restore test inside the window. It places the once-per-window items a third of the way in, one week apart, so each has a dated record before the window ends. Those placements are its planning assumptions, not a requirement.

Gaps between reports and bridge letters

A report covers a period that ends on a date. If the next window has not been reported on when a customer asks, they see a gap. A bridge letter is management's own statement about the time since the last report. The CPA firm that issued the report does not sign it or do work on the gap, and each customer decides how long a gap it will accept. The way to avoid a long gap is to plan the next window to begin when the last one ends, and agree the dates for consecutive periods with your firm when you sign the first engagement. Compass IT Compliance notes that a 12-month window aligns well with annual audit cycles (Compass IT Compliance).

After the period ends: fieldwork, sampling, report

Once the window closes, the firm begins fieldwork. It requests records dated inside the window, tests samples against your stated procedures, asks follow-up questions and drafts the report, which includes its opinion and any exceptions it found. Compass IT Compliance advises leaving at least one to two weeks between the end of the period and kickoff to compile final evidence (Compass IT Compliance). The planner assumes three weeks of fieldwork for a Type II report as a planning assumption you can change, and your firm's schedule sets the actual date.

Use the gap to prepare. The auditor interview prep and the mock audit let the people who will be asked questions practice answering them, and what auditors ask about policies lists the requests that come most often. For what the report itself costs, see what SOC 2 costs for a startup.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.