A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →The observation period is the window of time a SOC 2 Type II report covers, typically three to twelve months. The auditor samples evidence from across the whole window to confirm each control operated consistently, not just that it existed on the day of testing.
Controls need to be live and producing dated evidence before the window opens. Anything switched on inside it is only evidenced from the day it started.
Because the window has to elapse, it usually sets your report date rather than the control work does. Plan backwards from the date your buyer needs the report.
traztech delivers SOC 2 readiness and audit prep for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
It comes up as a date question and turns into a timeline problem. A Type II report attests that controls operated across a stated period, so the period has to elapse before the report can exist.
The expensive version is a control implemented partway through the window. Turning on MFA a fortnight before fieldwork gives you a fortnight of evidence in a three to twelve month period, and the rest of the window is an exception.
Three months is common for a first Type II and twelve for a mature cycle. Shorter is cheaper and faster, and some enterprise buyers discount it, so the length is a commercial decision as much as a technical one.
The auditor tests the whole period, so the months before implementation are exposed. The usual remedy is to move the window, which pushes the report by months.
No. You set the start date, and it should be after your controls are live and producing evidence. Choosing it well is one of the highest-leverage decisions in the programme.