For a first SOC 2 Type 2, three months is the usual answer when a deal is waiting and six months is the usual answer when it is not. After that, almost everyone settles into twelve-month periods that repeat annually. Choosing your SOC 2 observation window is really a commercial decision with an audit consequence, so it helps to see both sides.
There is no authoritative minimum. The AICPA does not set one. What exists is a practical floor — a period short enough that the auditor cannot meaningfully test whether controls operated is not worth issuing, and buyers who know what they are reading treat very short periods with suspicion. Three months has become the accepted shortest window in most markets, and even that gets questions from some enterprise reviewers.
What the window actually determines
The observation window is the period the auditor’s opinion on operating effectiveness covers. Everything the auditor tests has to have happened inside it.
That has a few direct consequences:
- Controls that run daily, weekly or per-event — access provisioning, change approvals, log review, onboarding, offboarding — will have populations inside almost any window. The window length mostly changes how large those populations are, and therefore sample sizes.
- Controls that run quarterly — most commonly access reviews — need at least one occurrence inside the window. A three-month window gives you exactly one chance, and if that quarter’s review slipped, there is no second sample to fall back on.
- Controls that run annually — penetration testing, risk assessment, business continuity or disaster recovery testing, policy review and approval, security awareness training, vendor reviews — may not naturally fall inside a short window at all.
That last group is where short windows get complicated. Approaches vary between firms, so this is a conversation to have with your auditor before you fix the dates. Some will test evidence that the annual control operated within its required frequency even if the occurrence falls before the period start; others will want the control to have operated inside the period. Ask specifically, and ask early, because the answer might move your start date by a month.
The case for three months
You choose three months when time is the binding constraint. A prospect has said they need a Type 2 before contract, your controls went live recently, and waiting until you have a year of history means losing the deal.
A three-month window also limits your exposure. If your controls have only been running consistently since February, a period starting 1 March tests the version of your company that has its act together. A twelve-month window starting the previous March would test six months during which half your controls did not exist, and every one of those months is a potential exception.
The trade-offs are real, though. Populations are small, so a single failure is a larger proportion of the sample. There is no room for a quarterly control to slip. And you will be back in an examination sooner, because the next report needs to pick up where this one ended.
The case for six
Six months is the compromise most first-timers land on when they have a little breathing room. Two quarters means two access review cycles, which means one can be imperfect without dominating the sample. Change and access populations are big enough to look like a real operating record. Annual controls are more likely to fall inside the period naturally.
It is also more persuasive to a sceptical reviewer than three months, without pushing your first report a full year out.
The case for twelve
Twelve months is the steady state. Nearly every mature SOC 2 programme runs a twelve-month period ending on the same date each year.
The reasons are practical. Every control frequency, including annual ones, occurs within the period without special handling. Your report is continuously current for buyers — with one annual examination, you have coverage for the whole year rather than repeating fieldwork twice. And a twelve-month period is what enterprise reviewers expect to see from an established vendor, so it stops being a topic of conversation.
The cost of getting there is that you cannot start with it unless you already have a year of evidenced controls behind you. Most companies do not.
Making the periods join up
This is the part first-timers miss, and it causes more awkward customer conversations than window length itself.
Your second report’s period should begin the day after your first report’s period ends. If your first Type 2 covers 1 April to 30 June, your second should start 1 July. If instead you take a breath and start the second period on 1 October, you have created a three-month gap in which no report says anything about your controls, and a diligent reviewer will notice.
That means the transition from a short first window to a twelve-month cadence has to be planned. A common pattern: a three-month first period, then a nine-month second period ending on the date you want to standardise on, then twelve-month periods from there. Another: three months, then twelve months starting immediately after, and accept that your annual date is set by wherever the first period happened to end.
Between the period end and your customer’s next question, a bridge letter — management’s signed statement that nothing material changed since the period end — covers the interim. It is not audited, and its credibility fades as the gap widens, so it is a stopgap, not a substitute for a contiguous next period.
Choosing your dates
Work backwards from three facts.
When your controls actually started operating consistently. Not when the policy was approved — when the first access review was completed, the first change ticket was approved by someone other than the author, the first offboarding ran through the checklist. Set your period start after that date. Starting earlier buys you nothing and costs you exceptions.
When the customer needs the report. Add fieldwork and reporting time to the end of your window. The auditor cannot test the period until it has finished, and the report is issued some weeks after that depending on the firm and how quickly evidence arrives. If your buyer needs a report in September, a window ending 31 August is optimistic.
Where your annual controls fall. If your pen test and risk assessment were done in February and your window runs May to July, raise it with your auditor before you commit to those dates.
What to do next
Put three dates on a page: the date your controls became consistent, the date your customer needs the report, and the dates of your last penetration test, risk assessment and access review. Take that page to your auditor and ask two questions — what period would you recommend, and how will you handle our annual controls if they fall outside it.
Then decide, before the first period even starts, what your second period will be, so the two join without a gap. Assurion plans observation windows with clients at scoping rather than after, because the dates are much cheaper to fix in advance than to explain afterwards.