SOC 2 Roadmap: 12-Month Plan From Scoping to Type 2 Report
8 min read ยท 2026-10-25
A SOC 2 roadmap is a plan that takes your company from no report to a SOC 2 Type 2 report, phase by phase: scoping, gap assessment, fixing controls, a Type 1 audit, an observation period and the Type 2 audit. Each phase has owners and a milestone, so leadership and sales know when the report will be ready for customers.
The template below covers 12 months, a common planning horizon for a first Type 2 when you start with few formal controls. Your real timeline depends on your scope, your current controls and the observation period you agree with your auditor. It is written for CTOs, security and compliance leads, IT managers and the project managers who coordinate the work. It stays at the planning level: confirm the exact criteria and evidence your audit needs with your CPA firm and the AICPA guidance.
The roadmap at a glance
Goal: A SOC 2 Type 2 report issued by your audit firm for the agreed scope, with every control owned, operating and backed by evidence. Duration: 12 months
Scope and plan (Weeks 1-4)
Decide what the report will cover and who will run the work.
- List the customer requests and deals that need the report, and the date sales needs it by.
- Choose the Trust Services Criteria in scope: Security is always included, then add Availability, Confidentiality, Processing Integrity or Privacy only if customers need them.
- Define the system boundary: products, infrastructure, teams, locations and vendors in scope.
- Name a compliance owner and an executive sponsor, and shortlist audit firms.
Milestone: Scope document approved by the sponsor and an audit firm engaged.
Gap assessment (Weeks 3-8)
Compare what you do today with what the criteria expect.
- Map your current practices to the criteria in scope, area by area.
- Run a readiness assessment with your auditor, a consultant or a compliance platform.
- List gaps with a severity, an owner and an estimated effort.
- Start a risk assessment and a vendor inventory.
Milestone: A gap list with owners and dates, reviewed with the sponsor.
Policies and remediation (Weeks 6-18)
Close the gaps and put controls in place.
- Write and approve the core policies, such as information security, access control, change management, incident response and vendor management.
- Set up controls in your systems: single sign-on and MFA, access reviews, logging, backups, encryption and change approvals.
- Roll out security awareness training and background checks as your policies require.
- Assign an owner to each control and decide how evidence will be collected.
Milestone: All gaps closed or accepted, policies approved and every control assigned to a named owner.
Type 1 audit (Weeks 18-24)
Confirm with the auditor that your controls are designed correctly.
- Agree the Type 1 date and evidence list with the auditor.
- Prepare the system description with engineering and the compliance owner.
- Answer auditor requests through one shared tracker.
- Fix any design issues the auditor raises.
Milestone: SOC 2 Type 1 report issued, or design findings fixed and accepted by the auditor.
Observation period (Weeks 22-46)
Run every control consistently and keep evidence for the whole window.
- Start the observation window on the date agreed with the auditor.
- Run recurring controls on schedule: quarterly access reviews, vulnerability scans, backup restore tests and vendor reviews.
- Hold a monthly control check to catch missed evidence early.
- Log exceptions as they happen and record how you fixed them.
Milestone: Observation window completed with evidence on file for every control and every period.
Type 2 audit and report (Weeks 46-52)
Let the auditor test the controls over the window and issue the report.
- Provide samples and evidence for the full window, as requested.
- Hold walkthroughs between control owners and the auditor.
- Write management responses to any exceptions.
- Review the draft report, then share the final report with customers under NDA.
Milestone: SOC 2 Type 2 report issued and the plan for the next audit period set.
SOC 2 Type 1 vs Type 2
A Type 1 report looks at the design of your controls at one point in time. A Type 2 report looks at whether those controls worked over a period, often several months. Many customers ask for Type 2 because it shows the controls run in practice, not just on paper.
Some companies go straight to Type 2. Others get a Type 1 first so sales has something to share while the observation window runs. Decide with sales and your auditor, based on what your largest prospects ask for and when.
Example: a filled-in SOC 2 roadmap
Picture a 60-person B2B SaaS company selling to mid-market finance teams. Two large deals are blocked until the company can share a SOC 2 report. Scope: Security and Availability for the production platform on AWS.
The plan uses a six-month observation window, agreed with the auditor, and a Type 1 in the middle so sales can share it during the window.
- Month 1 (CTO and compliance lead): scope set, audit firm engaged, sales informed of target dates. Check: signed engagement letter.
- Months 1-2 (compliance lead): readiness assessment finds 34 gaps, biggest in access reviews, vendor management and change approvals. Check: gap list approved.
- Months 2-5 (engineering manager, IT and HR): policies approved, SSO and MFA everywhere, pull request approval required, onboarding and offboarding checklists. Check: all gaps closed.
- Months 5-6 (compliance lead): Type 1 audit. Check: report shared with the two blocked prospects.
- Months 6-11 (control owners): observation window with monthly control checks. Check: evidence complete each month.
- Month 12 (compliance lead and auditor): Type 2 fieldwork and report. Check: final report in the trust portal.
Who owns what
SOC 2 is not a security team project. Controls live in engineering, IT, HR, finance and leadership, so owners must come from those teams. The compliance owner coordinates, but each control needs a person who runs it and keeps the evidence.
Write the owner next to each control in your control matrix, and review the list when people change roles. A control with no owner is a likely exception in the Type 2.
- Executive sponsor (CEO or CTO): approves scope, budget and policies, and signs the management assertion.
- Compliance owner: runs the roadmap, the control matrix, evidence tracking and the auditor relationship.
- Engineering manager: change management, code review, deployment and vulnerability management controls.
- IT or platform lead: access management, device management, logging, backups and monitoring.
- HR lead: background checks, onboarding, offboarding and training records.
- Finance or operations: vendor contracts and vendor risk reviews.
- Sales lead: customer requests, NDA process and sharing the report.
How to collect evidence without drowning
Evidence is where SOC 2 projects lose the most time. Decide early where evidence will live and how it will be collected, and keep it consistent for the whole window. Many teams use a compliance automation platform that connects to their cloud, identity and HR tools. Others use a shared folder and a tracker. Either works if the process is clear.
Set reminders for every recurring control, and check monthly that evidence is in place. Missing one quarterly access review can turn into an exception in the final report.
- Use a control matrix with columns for control, owner, frequency, evidence type and evidence location.
- Name files with the control ID and the date.
- Automate what you can, such as screenshots of settings, logs and ticket exports.
- Keep tickets for every access change and every production change.
- Record exceptions as they happen, with the fix and the date.
How to present it to leadership and sales
Leadership wants a single view: the six phases on a 12-month timeline, today marked, the date of the Type 1 and the Type 2 report, and the top risks. Add the deals that depend on the report, so the business value is clear.
For sales, write a short note they can send to prospects: scope, current status, expected report date and how to request it under NDA. Update it each month. Never promise a report date the auditor has not confirmed.
Risks and dependencies
Give each risk an owner and a fallback, and review them in the monthly control check. Most SOC 2 delays come from people and process, not technology.
The audit firm is also a dependency. Book fieldwork dates early, since many firms schedule weeks or months ahead.
- Control owner leaves: owner is the compliance lead. Fallback: a backup owner for every control.
- Missed recurring control: owner is the control owner. Fallback: calendar reminders and a monthly evidence check.
- Scope creep: owner is the sponsor. Fallback: keep new products out of scope until the next period.
- Vendor without a report: owner is operations. Fallback: a vendor questionnaire and a documented risk decision.
- Auditor availability: owner is the compliance lead. Fallback: book fieldwork at engagement.
How to adapt it
The phases stay the same for most companies. What changes is the length of remediation and the observation window.
Whatever your size, confirm scope, timing and evidence needs with your auditor before you commit dates to customers.
- Early-stage startup: keep scope to Security, use a compliance platform and expect founders to own several controls.
- Company with ISO 27001 already: map existing controls to the criteria to shorten the gap and remediation phases.
- Larger company: add internal audit, more systems and locations, and plan more time for evidence across teams.
- Second year: the roadmap becomes a cycle of continuous controls, a new observation period and an annual report.
Common mistakes to avoid
- Adding every Trust Services Criterion by default increases cost and effort, so include only Security plus the criteria customers actually ask for.
- Writing policies nobody follows creates exceptions in the Type 2, so write policies that match how your team really works and then enforce them.
- Leaving controls without named owners leads to missed evidence, so assign an owner and a backup to every control.
- Collecting evidence only at audit time leaves gaps in the window, so check evidence every month.
- Promising customers a report date before the auditor confirms fieldwork damages trust, so share dates only after they are booked.
- Treating SOC 2 as a one-time project lets controls decay, so plan the next observation period before the first report is issued.
Frequently asked questions
How long does it take to get a SOC 2 report?
It depends on your starting point, scope and observation period. A Type 1 can come after a few months of preparation. A Type 2 adds an observation window that your auditor agrees with you, often several months, plus time for fieldwork and the report.
What is the difference between SOC 2 Type 1 and Type 2?
Type 1 tests whether controls are designed correctly at a point in time. Type 2 tests whether they worked over a period. Customers usually prefer Type 2 because it shows the controls operate in practice.
Which Trust Services Criteria do I need?
Security is always in scope. Availability, Confidentiality, Processing Integrity and Privacy are optional and depend on your service and what customers ask for. Confirm the scope with your auditor before you start remediation.
Who issues a SOC 2 report?
A licensed CPA firm performs the audit and issues the report under AICPA standards. Readiness consultants and compliance platforms can help you prepare, but the report itself comes from the audit firm.
Do I need a compliance platform for SOC 2?
No, but many teams use one to track controls and collect evidence automatically. A clear control matrix, shared evidence folders and calendar reminders can also work for a small scope. Pick the approach your team will keep up for the whole observation period.