What is a SOC 2 observation period?
What Is the Observation Period?
The observation period is the window of time that a SOC 2 Type II audit covers. During this period, your controls must be in place and operating effectively. The auditor tests evidence from across the entire window to confirm your controls worked consistently.
This is the key difference between Type I and Type II. Type I checks controls at a single point in time. Type II checks controls across the observation period.
How Long Is the Observation Period?
| Duration | When It Is Used | Trade-offs |
|---|---|---|
| 3 months | Minimum acceptable; common for first Type II | Faster, but some buyers prefer 6+ months |
| 6 months | Most common for initial Type II audits | Good balance of speed and credibility |
| 9 months | Less common; timing alignment with fiscal year | Longer evidence collection burden |
| 12 months | Standard for mature organizations | Maximum coverage, longest wait |
Most startups doing their first Type II choose a 3- or 6-month observation period.
What Happens During the Observation Period?
You are expected to:
- Operate controls consistently — If your policy says quarterly access reviews, you need to actually do them and have evidence
- Collect evidence continuously — Screenshots, logs, and records must cover the entire window
- Respond to incidents — Security events need documented incident response
- Maintain documentation — Policy changes, system changes, and personnel changes should be tracked
When Does It Start?
There is no formal start event. The observation period begins when your controls are in place and operating. If you complete a Type I on March 1, your Type II observation can begin March 2.
What If Something Goes Wrong?
A control failure during the observation period does not automatically ruin your audit. Auditors expect occasional issues — what matters is how you detect and respond. If your monitoring catches a violation and your incident response handles it properly, that is evidence of a working control. Screenata collects evidence continuously throughout the observation period so nothing falls through the cracks.