SOC 2 Type II: what the audit covers and how long it takes

What is SOC 2 Type II?

SOC 2 Type II is an independent audit report, under the AICPA’s SOC 2 framework, on whether a company’s security controls actually operated effectively over a period of time, usually three to twelve months.

It is often written SOC 2 Type 2, and it is the version most enterprise customers ask for, because it shows controls working in practice rather than only on paper.

What a SOC 2 Type II audit tests

A licensed CPA firm takes samples from across the audit period and checks each control against them: were leavers’ accounts removed on time, were code changes reviewed, were backups tested? A Type I report checks that controls are sensibly designed on a single date; a Type II report checks that they kept working, which is why it takes longer and carries more weight.

SOC 2 Type II requirements

There is no fixed checklist. You choose which Trust Services Criteria are in scope (security is always included), define controls that meet them, and then need evidence that each control operated throughout the period. Typical areas are access management, change management, risk assessment, vendor management, incident response and monitoring.

How long does SOC 2 Type II take?

Expect a few weeks to a few months of preparation, depending on what is already in place; then the observation period itself, commonly three to six months for a first report and twelve months after that; then several weeks for the auditor to write the report. Many companies get a Type I first, so they have something to show while the Type II period runs.

What is in a SOC 2 Type II report

The auditor’s opinion, management’s description of the system, the controls tested, the tests performed and their results, including any exceptions. Customers usually receive it under an NDA. Compliance as a Service for SMBs prepares you for the audit with a control checklist, generated policies and evidence tracking; the auditor’s work and fee stay separate.

Last reviewed 2026-11-01.

Related terms

  • SOC 2 Type I — SOC 2 Type I is an audit report on whether a company’s security controls are suitably designed and in place on one specific date.
  • Trust Services Criteria — The Trust Services Criteria are the five categories a SOC 2 report can cover: security, availability, processing integrity, confidentiality and privacy.
  • Readiness assessment — A readiness assessment is a rehearsal of an audit: a review of your controls, policies and evidence against a framework such as SOC 2, done before the real audit so gaps can be fixed while it is still cheap.

All glossary terms →