The Type 2 observation window, and who sets its length

The length of a SOC 2 Type 2 observation window tends to get treated as a given — a number that came from somewhere else and is not open to discussion.

In our view it is worth knowing where that number comes from, because the answer has more moving parts than a stated length implies. The window is not a setting on a form. It is a decision with several parties in it, and the one constraint nobody can negotiate is how far back your own evidence goes.

What the window actually is

The observation window is the span of dates the report's conclusion attaches to.

A point-in-time report says something about how matters stood on a single day. A period report says something about how controls ran across a stretch of calendar — which means evidence has to exist for the whole stretch, not only for the week the auditor asked. If you want the distinction between those two report types first, SOC 2 Type 1 vs Type 2 covers it.

One regulator document sets out the period idea in the financial reporting context. The SEC staff's 2004 FAQ on management's report on internal control over financial reporting hangs a footnote off the question text in Question 14, and that footnote says "AU sec 324 defines a report on controls placed in operation and test of operating effectiveness, commonly referred to as a 'Type 2 SAS 70 report'". It describes that report as covering, among other things, "whether they had been placed in operation as of a specific date, and on whether the controls that were tested were operating with sufficient effectiveness to provide reasonable, but not absolute, assurance that the related control objectives were achieved during the period specified."

That footnote sits in a FAQ about a registrant's own report on internal control over financial reporting. The words worth sitting with are "during the period specified." In our view that is the whole subject here: a period report's conclusion is fenced in by dates, and somebody has to choose them.

Who has a say

Our view of how the length gets settled, and who can stop you:

Who	What they control	How to find out
You	The dates you propose, and when controls started running	Your own evidence, not your intentions
Your evidence	The earliest honest start date	When retained records actually begin
Your auditor	Whether the proposed period can be tested	Ask before the engagement is scoped
Your buyer	Whether the finished report clears their bar	Their third-party risk policy, in writing

Working through them in turn:

You propose the dates. The window is something you put forward as part of scoping, with an end date chosen to sit a sensible distance before the deadline you actually care about — because fieldwork and report issuance happen after the window closes, not inside it.

Your retained evidence sets the floor. This is the hard constraint. A period you cannot show records for is not a period you can propose, however badly the deal needs it.

Your auditor has to be able to test it. A firm that does not believe it can get enough evidence over the span you suggested will say so, and in our view that conversation is better had before an engagement letter than after.

Your buyer decides whether the result is enough. This is the part founders tend to treat as fixed and is in fact the part most worth asking about directly. For banking organizations, the 2023 interagency guidance on third-party relationships from the Federal Reserve, the FDIC and the OCC says that "when relevant and available, a banking organization may consider reviewing System and Organization Control (SOC) reports and any conformity assessment or certification by independent third parties related to relevant domestic or international standards," and that "it would be appropriate to consider whether contract provisions describe the types and frequency of audit reports the banking organization is entitled to receive from the third party (for example, SOC reports, Payment Card Industry (PCI) compliance reports, or other financial and operational reviews)." Both passages are written permissively, and whether any of this reaches a particular buyer is a question for that buyer and their counsel. The practical point for a vendor is that acceptability tends to live in somebody's contract and policy language, where it can be read rather than guessed at.

If you have been told a particular length is required, the useful response is to ask which document says so, and then read the sentence yourself. In our view the questions that actually decide the dates are what your evidence can support and what your buyer's policy accepts.

The start date is not the day you sign

The clock starts when the controls are operating and you are keeping evidence of them. Not when a readiness project kicks off, not when an auditor is selected, not when a platform is purchased.

That is why engaging early does not by itself pull a report date forward, and it is why the honest test of a proposed start date is documentary. For each control in scope, ask what a reviewer could be handed for the first week of the window:

• An access review with a completed cycle sitting inside the span, with the reviewer, the date and the decisions visible — the access review an auditor will accept sets out what that evidence has to look like.
• Change records for changes that really happened, flowing through the process you described rather than around it.
• Joiner and leaver records for the people who actually joined and left during the span.
• A restore that was performed and documented, not a backup job that reported success.
• Vendor and subservice reviews with dates on them.

Where the answer is "we would have to reconstruct that," the window does not start there. Nothing created later turns into operating history.

Length is a trade, not a target

A shorter window gets a document into a buyer's hands sooner and gives a reviewer less operating history to look at. A longer window reads more convincingly, costs more in evidence production, and raises the chance that something will go wrong inside it and be written down.

In our view that last point is an argument for the longer window rather than against it. A control that fails during an observed period is a problem with a date, an owner and a remediation trail. The same control failing inside a period nobody observed is a problem you will meet later, with none of that around it.

The other half of the trade is what happens after the end date. A report covers a span that has already closed, and that span only gets older. Plan the next window before anyone asks about the distance from the last one.

Your buyer's year does not stop when your window does

Buyers come back, and generally not because anything about you changed.

For the financial institutions the FTC's Safeguards Rule reaches, the FTC's guidance says to "select service providers with the skills and experience to maintain appropriate safeguards," and that "your contracts must spell out your security expectations, build in ways to monitor your service provider's work, and provide for periodic reassessments of their suitability for the job." That guidance addresses those institutions' own programs and their contracts with their service providers.

The interagency guidance frames ongoing monitoring in terms of risk rather than a schedule, saying that "a banking organization's ongoing monitoring, like other third-party risk management processes, should be appropriate for the risks associated with each third-party relationship, commensurate with the banking organization's size, complexity, and risk profile and with the nature of its third-party relationships."

Alongside that, NIST's glossary gives "continuous monitoring" as "Maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions," a definition drawn from NIST SP 800-137.

In our view the sensible way to read your own window against all of that is as a recurring commitment rather than a project with an end. The dates on one report are the part a reviewer can verify; the operating discipline behind them is what makes the next window cheaper than the first.

Where to start

In order, and none of them requires an auditor to have been chosen first:

1. Write down the earliest date your evidence actually supports, control by control, using the documentary test above rather than your memory of when work began.
2. Ask the buyer in writing what their policy accepts — report type, coverage, and how recent the end date has to be. Ask before you scope anything.
3. Pick an end date that leaves room behind it for fieldwork and issuance before the date that matters commercially, then work the start date back from there.

If you are trying to see whether a customer's date is still reachable, the SOC 2 timeline calculator maps the sequence against it. If the earliest honest start date is the thing you are unsure about, the readiness scorecard will show you which gaps are standing between today and a window you could defend.

This is general information, not audit, security or legal advice. Confirm what applies to you with your auditor or counsel.

Common questions

What is a Type 2 observation window?

It is the span of dates the report's conclusion attaches to — the stretch of calendar across which the auditor looks at whether your controls actually ran, rather than a single day on which they existed. Evidence has to exist across the whole span, which is why the window cannot be assembled after it closes.

Who decides how long the window runs?

In our view, more than one party has a say and nobody hands you the answer. You propose the dates, your retained evidence sets the earliest date you could honestly start from, your auditor has to be satisfied it can test the period you proposed, and your buyer's own policy decides whether the finished report clears their bar.

When does the window actually start?

When your controls are operating and you are keeping evidence of them, not when you sign an engagement letter or kick off a readiness project. Signing earlier does not move a report date forward, because nothing before the controls ran counts toward the period.

Can we shorten the window to hit a customer's deadline?

Only within what your evidence supports and what your auditor is willing to test, and even then the buyer's policy still has to accept the result. If the deadline sits inside the shortest span you could honestly evidence, the conversation worth having is about the date rather than about the window.

What happens if a control fails partway through the window?

You are better off knowing. In our view a failure found inside the window is a fixable problem with a documented history, while a window shortened to avoid finding it leaves the same weakness in place with less evidence around it. Ask your auditor early how a failure and its remediation would be described.

Is a longer window better?

It is more convincing and more expensive. A longer span gives a reviewer more operating history and gives you more evidence to produce and more opportunity for an exception to surface; a shorter one gets a document into a buyer's hands sooner. The right answer depends on the deadline you are working against and what your evidence can support.

Sources

1. Frequently Asked Questions: Management's Report on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports (revised October 6, 2004) — Question 14 · U.S. Securities and Exchange Commission, Office of the Chief Accountant and Division of Corporation Finance
2. Interagency Guidance on Third-Party Relationships: Risk Management, 88 FR 37920 · Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation and Office of the Comptroller of the Currency, via the U.S. Government Publishing Office
3. FTC Safeguards Rule: What Your Business Needs to Know · Federal Trade Commission
4. Computer Security Resource Center Glossary — 'continuous monitoring' (definition drawn from NIST SP 800-137) · National Institute of Standards and Technology