SOC 2 Type II: the observation window is the whole exam

The gap between a SOC 2 Type I and a Type II is not paperwork. It is time. Type I is a photograph of your control environment on a single date. Type II watches those controls for a period — commonly three to twelve months — and reports on whether they operated consistently throughout. Everything difficult about SOC 2 lives in that difference.

Why teams pass Type I and stumble on Type II

Controls designed for a photograph tend to be manual. Someone reviews access quarterly. Someone approves the change. Someone checks the backup restored. On the day of a Type I assessment, all of that can be demonstrated. Across a nine-month observation window, it has to have actually happened, on schedule, with evidence, every time.

Auditors sample. If your control says access reviews happen quarterly and the window covers three quarters, they will ask for three reviews. Two out of three is an exception, and exceptions land in the report your customers read.

Design for evidence, not for the description

• Prefer controls that produce evidence automatically — a ticket, a log, a pipeline artefact — over ones that rely on someone remembering to screenshot something.
• Write control frequencies you can actually sustain. Monthly sounds diligent until month four. Quarterly that always happens beats monthly that sometimes does.
• Name an owner for every control, and make that owner a role rather than a person who might change teams.
• Keep evidence in one place with a consistent naming convention. Hunting for artefacts at audit time is where weeks disappear.

Scoping the system description

The system description defines what the report covers. Draw it too wide and you have committed to evidencing controls across your entire company, including functions your customers never touch. Draw it too narrow and buyers will notice the product they use is not in scope. The right boundary is the production system that delivers the service, its supporting infrastructure, and the processes that change it.

Choosing your Trust Services Criteria

Security is mandatory. Availability, Confidentiality, Processing Integrity and Privacy are optional, and each one adds controls, evidence and cost. Add them because a customer contract requires them, not because the list looked incomplete. You can add a category in a later report period; removing one looks worse than never having claimed it.

A realistic timeline

For a team starting from nothing: six to ten weeks of readiness work to design controls and close gaps, then the observation window itself, then four to six weeks for fieldwork and report production. Committing to a customer date without accounting for the window is the single most common planning mistake in a first SOC 2.

Templates shorten the readiness phase, not the observation window. Nothing shortens the observation window — which is exactly why starting it early matters more than starting it perfectly.