SOC 2 Timeline Calculator
Procurement asked for a SOC 2 and gave you a date. This estimates when a Type 1 or Type 2 report could realistically be in hand, given where your controls stand today — and says plainly if the date is already gone.
Runs in your browser. Nothing you type is sent anywhere unless you choose to export it. Privacy
Your answers are mirrored into this page's address so you can bookmark or share the result.
Not sure? A Type 1 first is the usual answer when the deadline is close.
The date the buyer expects a report in hand. Leave blank if you only want the timeline.
Signed off, with the export kept.
Inventory of vendors, critical ones reviewed and documented.
Written, roles named, tested at least once.
Screenshots, exports, tickets being captured per control on a cadence.
Cloud, identity provider, code hosting, ticketing, HR, monitoring, key SaaS. Most early-stage companies land between 5 and 12.
Someone whose job includes this, not someone who was cc'd.
Answer the questions on the left to see when a Type 1 report could realistically be in hand and whether your deadline fits.
Read nextSOC 2 Type 1 vs Type 2: which one actually unblocks the deal?SOC 2 · 7 min readHow to run an access review an auditor will acceptVendor reviews · 6 min readAI agents and SOC 2: the audit trail your auditor is about to ask forSOC 2 · 7 min read
This is a planning estimate built from stated assumptions and your answers. It is not an audit opinion, not a readiness assessment, and not a commitment on any auditor's calendar. Actual timelines depend on scope, evidence quality, and the firm you engage. Audits and attestations are performed by Alpha Secure LLP, a licensed CPA firm. Disclosure.