Sixty days is a readiness target, not a promise of a SOC 2 report. Readiness means your scope is fixed, policies are approved, controls are designed and running, evidence is flowing, and an auditor is engaged. Whether you hit that date depends on how many gaps the assessment uncovers and how quickly engineering can close them. The report itself follows on the auditor's timeline, and for a Type II it cannot arrive until an observation period has run.
Type I, Type II, and where the calendar goes
Many teams run both: a Type I shortly after readiness, with the Type II observation period starting as soon as controls are operating. Some buyers asking for a Type II will accept a Type I plus a letter confirming the Type II period is underway. If you are still deciding between frameworks, ISO 27001 vs SOC 2 compares the two paths.
The 60-day plan, phase by phase
Scoping decisions that shape the whole project
- Criteria. Security, the common criteria, is always included. Add Availability, Confidentiality, Processing Integrity, or Privacy only when customers ask for them, since each adds controls and testing. The Trust Services Criteria entry explains each category.
- System boundary. Include the product customers buy and the infrastructure, code pipeline, and support tooling that touch their data. Excluding them saves effort now and costs credibility in every security review.
- Subservice organizations. Cloud providers are usually carved out, meaning your report relies on their own reports and lists the complementary controls you expect them to operate.
- Complementary user entity controls. Document what customers must do themselves, such as managing their own user access in your product.
Who needs to be involved
- Executive sponsor who can move engineering priorities and sign the management assertion.
- Compliance lead who owns the plan, the control matrix, and auditor communication.
- Engineering and infrastructure owners for access, change management, logging, backups, and vulnerability management.
- People operations for onboarding and offboarding, background checks where used, and training records.
- Security or IT lead for endpoint management, identity provider configuration, and incident response.
Blockers that push the date
- Policies approved but not followed. An auditor tests what happens, not what the document says.
- Change management gaps, such as direct pushes to the main branch or production changes without a ticket.
- No record that quarterly or annual activities ever happened, even if people did them informally.
- Offboarding that relies on memory, leaving departed staff with active accounts in secondary tools.
- Waiting on a single engineer who owns all infrastructure changes and is also shipping product.
- Choosing an auditor late, then discovering their availability does not match your target start date.
How to measure progress
Weekly readiness indicators
- Percentage of controls with a named owner
- Percentage of policies approved and published to staff
- Percentage of controls with at least one current evidence item, tracked in something like our audit evidence tracker
- Open gaps by severity, and the count closed this week
- Staff completion rate for security training and policy acknowledgement
- Number of controls that would produce an exception if tested today
Running this plan in Asurvo
Asurvo's AI learns your organization's context, then generates controls and drafts policies specific to how you operate, which shortens the policy and gap phases. Native integrations with cloud, identity, and engineering systems pull evidence continuously and map it to SOC 2 controls, and owners work from a task queue. When fieldwork starts, auditors use their own workspace for requests, evidence, and findings. The Starter plan includes one framework certification, SOC 2 or ISO 27001, plus one penetration test.