How to pass SOC 2 Type 2: a practical roadmap

Sahil Dubey

CISA · CISM · AWS Solutions Architect Professional · 27 Jul 2026

Type 2 isn't a test you cram for - it proves your controls operated over months. Here's the sequence that gets you to a clean report without a fire drill.

Type 1 vs Type 2 in one line

Type 1 says your controls are designed correctly at a point in time. Type 2 proves they actually operated over a period — commonly three to twelve months. Type 2 is what most enterprise buyers want, and you can't cram for it: the evidence is generated by controls running day after day.

The roadmap

1. Scope and select criteria

Decide which Trust Services Criteria apply. Security (the Common Criteria) is mandatory; add Availability, Confidentiality, Processing Integrity or Privacy only if they're relevant to your service.

2. Gap assessment

Compare current state to the criteria and produce a prioritised gap register. This is where you learn how far off you really are.

3. Remediate and implement in AWS

Turn gaps into real controls: least-privilege IAM and MFA, KMS encryption, CloudTrail and Config, change management through a reviewed CI/CD pipeline, backups with tested restore.

4. Automate evidence

Wire controls so they emit evidence automatically — access reviews, pipeline logs, config snapshots — instead of screenshotting things the night before fieldwork.

5. Pick the observation window

Choose the window (often three to six months for a first Type 2). Controls must operate for the whole period.

6. Operate and monitor

Run the controls, catch drift, remediate on an SLA. Consistency over the window is what the auditor tests.

7. Auditor fieldwork

The auditor samples evidence across the window and writes the report. Clean evidence collected all along makes this fast.

The controls auditors actually check

Why teams fail (or stall)

• Treating it as a document exercise while the account tells a different story.
• Collecting evidence manually and burning out before the window ends.
• Controls that work in one region but are switched off in another.
• No one owning remediation, so drift accumulates.

My take

The teams that pass Type 2 the first time don't work harder during fieldwork — they front-loaded the controls and automated the evidence, so the observation window ran itself. Build it right once, then let it operate.