How long does SOC 2 take?

It depends on what you already have, how many people and systems are in scope, the report type, the observation window you agree with your CPA firm and the firm's own schedule. This planner does not quote a typical figure. It builds a schedule from assumptions it shows you, so you can replace each one with your own estimate. For a Type II report, the window you choose sets a floor: the report comes after the window ends and fieldwork is done.

Can the observation window start before every control is in place?

The auditor tests whether each control operated throughout the window, so a control that starts halfway through has no records for the first half, and that gap can appear in the report. That is why this plan starts the window the day after the readiness review is complete. Agree the start date with your CPA firm.

How does the readiness check change the plan?

If you open the planner from the readiness check results, it reads your 20 answers from the page address. A task whose questions you answered yes becomes a one-week evidence check, partly halves it, and no keeps the full duration. Your answer about approved policies also fills in whether policies are already written.

Are my answers stored or sent anywhere?

No. The planner runs in your browser and keeps your answers in the page address after the # sign, which browsers do not send to servers. The Excel and calendar files are built on your device.

SOC 2 timeline planner

Answer a few questions and get a dated, week-by-week SOC 2 project plan: scoping, the 22 policies, the controls and the evidence each one leaves, the CPA firm, and the examination or observation window. Every task has an owner role and a link to the free template that helps. Download it as Excel or put the milestones in your calendar. No signup, nothing leaves your browser.

Type I or Type II: what changes in the plan

A Type I report covers whether your controls are suitably designed as of one date, so the plan ends with an examination date, a short fieldwork period and the report. A Type II report covers whether the controls operated over a period, so the plan adds an observation window of the length you choose. Inside it, the planner schedules the recurring controls the auditor will sample: a quarterly access review in each quarter, plus a risk register review, a vendor review, an incident response tabletop and a backup restore test. Fieldwork starts after the window ends. The SOC 2 Type I vs Type II guide covers what the auditor does differently in each.

Where the plan comes from

The tasks are built from the same data as the rest of this site, so they stay in step with it:

Owners come from the policy registry: each control task belongs to the owner role of the policy that requires it. Across the 22 policies that is Security Owner (10), Engineering Lead (8), IT/Operations Lead (3), People/HR Lead (1). Steps that belong to nobody in the registry name the approver, the CPA firm or each policy’s owner.
Evidence for each task is quoted from the evidence checklist behind the criteria pages, with the criterion it supports.
Your progress comes from the readiness check: every one of its 20 questions maps to a task, so a yes there shortens the matching task here.
Templates: each task links to the free page that helps with it, including the gap assessment, risk register, access review, vendor questionnaire, incident response plan, business continuity plan, retention schedule and system description templates.

Planning assumptions

Every duration in this plan is an editable planning assumption chosen by Policyseed to give you a starting schedule. None is a benchmark, a statistic or a prediction of how long your project or your CPA firm will take. Replace them with your own estimates and the dates your CPA firm agrees with you.

Base durations. Each task has a base duration in weeks for a 1-10 person team, for example 2 weeks to write the 22 policies from scratch and 2 weeks for owner review and approval of all 22. The per-task table lists every one.
Team size. Internal work is multiplied by team size, because more people, systems and approvers take longer to coordinate: 1-10 people x 1, 11-50 people x 1.25, 51-200 people x 1.5, 201+ people x 2. Results are rounded to the nearest whole week (halves round up), with a minimum of 1 week.
Policies already written. Writing and approving the policies is multiplied by 0.5 when they are partly written and by 0.25 when they are written (time to check them against the 22 topics and re-approve).
Readiness check answers. When you came from the readiness check, a task whose questions you answered yes shrinks to 1 week to confirm the evidence, partly halves it, and no or unanswered keeps the full duration. Where a task covers several questions, the least favorable answer counts.
Order of work. Control work starts after the policies are approved, because the policies say what each control must do. Tasks in the same phase run in parallel; a task with a prerequisite starts the day after it ends. Engaging the CPA firm runs alongside the control work.
CPA firm steps. Engaging a firm (3 weeks), fieldwork (2 weeks for Type I, 3 weeks for Type II) and report drafting and issuance (3 weeks) are not scaled by team size. The firm sets these dates; use theirs once you have them.
Calendar. Week 1 starts on your start date. Durations are calendar weeks with no allowance for holidays or other projects.

Base durations before any adjustment, for a team of 1-10 people:

Phase	Task	Base weeks	Scaled by team size
1. Scope and gap assessment	Name the Security Owner and set the report scope	1	Yes
1. Scope and gap assessment	Run the readiness check and the gap assessment	1	Yes
2. Write and approve policies	Write the 22 policies	2	Yes
2. Write and approve policies	Owner review and management approval of the policies	2	Yes
2. Write and approve policies	Policy acknowledgment by all staff	1	Yes
3. Implement and evidence controls	Security awareness training for everyone	1	Yes
3. Implement and evidence controls	Onboarding and offboarding checklists	1	Yes
3. Implement and evidence controls	Multi-factor authentication everywhere and access through SSO groups	2	Yes
3. Implement and evidence controls	Pull request review and pipeline-only deployments	2	Yes
3. Implement and evidence controls	Vulnerability scanning and central logging with alerts	3	Yes
3. Implement and evidence controls	Laptop encryption, device management and data classification	2	Yes
3. Implement and evidence controls	Data retention schedule	1	Yes
3. Implement and evidence controls	Risk assessment and risk register	2	Yes
3. Implement and evidence controls	First user access review	1	Yes
3. Implement and evidence controls	Vendor inventory and vendor reviews	2	Yes
3. Implement and evidence controls	Incident response plan and tabletop exercise	2	Yes
3. Implement and evidence controls	Business continuity and disaster recovery plan	2	Yes
3. Implement and evidence controls	Backup restore test	1	Yes
3. Implement and evidence controls	Draft the system description	2	Yes
4. CPA firm and readiness review	Shortlist and engage a CPA firm	3	No
4. CPA firm and readiness review	Readiness review of the evidence	1	Yes
4. CPA firm and readiness review	Close the readiness findings	1	Yes
5. Observation window	Quarterly access review (each quarter of the window)	1	Yes
5. Observation window	Risk register review inside the window	1	Yes
5. Observation window	Vendor review inside the window	1	Yes
5. Observation window	Incident response tabletop inside the window	1	Yes
5. Observation window	Backup restore test inside the window	1	Yes
6. Fieldwork and report	Fieldwork: walkthroughs and document requests	2 (Type I), 3 (Type II)	No
6. Fieldwork and report	Report drafting, management review and issuance	3	No

The plan you build shows how each task’s weeks were set, and the Excel file repeats it on its Assumptions sheet. The workbook’s dates are formulas over those weeks, so editing one re-dates the tasks that follow it.

Before you start

Run the readiness check first and open this planner from its results, so the controls you already run are marked as further along.
For the criterion-by-criterion view with an owner and a fix per row, use the gap assessment template.
The policies are among the first documents an auditor asks for. The free generator writes all 22 around your tools.

Frequently asked questions

How long does SOC 2 take?: It depends on what you already have, how many people and systems are in scope, the report type, the observation window you agree with your CPA firm and the firm's own schedule. This planner does not quote a typical figure. It builds a schedule from assumptions it shows you, so you can replace each one with your own estimate. For a Type II report, the window you choose sets a floor: the report comes after the window ends and fieldwork is done.
Should I plan for a Type I or a Type II report?: Ask the customers who requested the report which one they accept. A Type I covers the design of your controls as of one date, so it can come sooner. A Type II covers whether the controls operated over a period, so the plan includes the observation window. The policies are the same for both; what changes is how long you must run the controls before the examination.
Can the observation window start before every control is in place?: The auditor tests whether each control operated throughout the window, so a control that starts halfway through has no records for the first half, and that gap can appear in the report. That is why this plan starts the window the day after the readiness review is complete. Agree the start date with your CPA firm.
How does the readiness check change the plan?: If you open the planner from the readiness check results, it reads your 20 answers from the page address. A task whose questions you answered yes becomes a one-week evidence check, partly halves it, and no keeps the full duration. Your answer about approved policies also fills in whether policies are already written.
Are my answers stored or sent anywhere?: No. The planner runs in your browser and keeps your answers in the page address after the # sign, which browsers do not send to servers. The Excel and calendar files are built on your device.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.