How to Get SOC 2 Type 2: What Buyers Should Verify

"How to get SOC 2 Type 2 certification" is one of the most common searches in vendor security, and the premise is slightly wrong. SOC 2 is not a certificate a company earns once and keeps forever. It is a report an independent CPA firm issues after testing a vendor's controls against the AICPA's Trust Services Criteria over a defined period, usually six to twelve months. There is no such thing as "SOC 2 certified", only a current report from a named firm, covering a stated period, for a stated scope. This article follows the Type II process from the vendor's side, from scoping to the final report, and maps each milestone, including the bridge letter gap and auditor scope, to the exact field a buyer should ask the index or the vendor to confirm.

SOC 2 Type II: a report, not a certificate

SOC 2 sits in the AICPA's System and Organization Controls suite alongside SOC 1 and SOC 3. A Type I report tests whether controls are designed suitably at a single point in time. A Type II report goes further: it tests whether those controls actually operated effectively across an observation window, usually at least three months and commonly six or twelve. The difference matters because a Type I report tells a buyer that a control exists, while a Type II report tells a buyer that the control was tested and held up over time. See SOC 2 Type I vs Type II for the full comparison, and the SOC 2 framework page for which vendors in the index currently hold a report.

Step one: scope the engagement before anyone books an auditor

Every Type II engagement starts with scope, and scope is where most of the eventual report's value, or its limits, get set. Security is the only mandatory Trust Services Criteria category; availability, confidentiality, processing integrity and privacy are added only if the vendor and auditor agree they are relevant. A vendor can narrow the system description to a single product line, exclude a newly acquired business unit, or carve out a subservice organisation such as its cloud host. None of that is wrong on its own, but it changes what the report actually proves. A buyer who assumes a SOC 2 report covers every product the vendor sells, every data centre it uses and every control category that sounds relevant is making an assumption the report itself may not support. The system description section, not the headline claim, states what was actually in scope.

The audit timeline, from the vendor's side

In practice, a Type II report follows a predictable sequence. Vendors that compress this timeline, or skip steps, tend to produce reports with gaps a careful buyer should notice.

1. 1

   Readiness assessment

   An internal or consultant-led gap analysis against the chosen Trust Services Criteria, usually four to eight weeks.

2. 2

   Remediation

   Closing control gaps found in readiness, which can take anywhere from a few weeks to several months depending on what is missing.

3. 3

   Optional Type I report

   A point-in-time opinion some vendors publish before starting the longer Type II window, mainly to reassure early customers.

4. 4

   Observation window opens

   The clock that matters starts here, not at kickoff. Everything the auditor later tests happened, or did not, inside this window.

5. 5

   Evidence collection

   Access logs, change tickets, training records and incident data are gathered continuously, ideally through the window rather than reconstructed at the end.

6. 6

   Fieldwork and testing

   The auditor samples evidence, interviews control owners and tests exceptions. This is the stage a rushed vendor shortens at its own risk.

7. 7

   Report issuance

   The CPA firm delivers an opinion, qualified or unqualified, alongside the system description and detailed control test results.

Choosing an auditor buyers can actually verify

The report's credibility rests on the firm that signed it, not the vendor's own narrative. A licensed CPA firm subject to AICPA peer review carries different weight than an unnamed independent assessor. Buyers reviewing a claim should ask which firm issued the report and check it against the list of auditors and certification bodies the index tracks, rather than accepting a logo on a trust centre as proof.

The observation window matters more than the badge

A trust centre badge that simply says SOC 2 Type 2 tells a buyer almost nothing on its own. It does not say which period the report covers, whether that period has already closed, or whether a new audit is underway. Reports commonly cover a twelve month window and are refreshed annually, which means a report tied to a period that ended eighteen months ago may already be stale by the time a buyer reads it. The fix is simple: ask for the period end date, not just the framework name, before treating a badge as current evidence.

The bridge letter gap

Between the end of one Type II period and the issuance of the next report, there is almost always a gap of a few weeks to a few months while the auditor completes fieldwork. Vendors cover that gap with a bridge letter, sometimes called a gap letter, a short management-asserted statement that no material changes to the control environment have occurred since the last report period ended. A bridge letter is not new audit testing. It is management's word, not the auditor's opinion. What is a bridge letter, and how much should a buyer trust one? covers what the letter can and cannot promise, and why a buyer should ask for the actual next report rather than relying on bridge letters indefinitely.

A SOC 2 report is based on management's description of the system and the suitability of the design and operating effectiveness of controls relevant to the Trust Services Criteria.

What buyers should verify in the index or from the vendor

Before asking a sales contact for a full report under NDA, check what the vendor already publishes. The card below shows the fields that matter for a Type II claim: whether the report type is stated explicitly, whether an auditor is named, and how that evidence sits alongside other frameworks the vendor holds. It is a useful second check before chasing a document request.

Paylocity · Trust report

Finance and accounting · Public evidence as of 2 Nov 2026

Visit trust centreFull evidence

Framework overview

CertReports state for each framework with public evidence: 1 verified, 3 vendor-stated.

• SOC 2Vendor-statedType II report
• DPFVerifiedValid to 2 Feb 2027
• ISO 27001Vendor-statedTrust centre · 30 Sep 2026
• SOC 1Vendor-statedType II report

3Documents and agreements

Legal and review documents Paylocity publishes or offers, as of 30 Sep 2026.

• Business associate agreement · Public
• Subprocessor list · On request
• Privacy policy · Public

1Security practices

Public statements from Paylocity, shown as statements, not attestations, as of 30 Sep 2026.

• Penetration testing · report available

• Report type: Type I or Type II, stated explicitly rather than just SOC 2
• Period end date: the most recent date the report actually covers
• Auditor name: a named, licensed CPA firm rather than an unspecified assessor
• Trust Services Criteria covered: security plus any optional categories claimed
• Carve-outs: subservice organisations excluded from testing
• Bridge letter: present and current, or absent entirely

Reading the report once you have it

A Type II report itself usually runs to fifty or a hundred pages, most of it detailed control test results that non-auditors rarely read in full. How to read a SOC 2 report in 20 minutes sets out which sections to prioritise: the opinion letter, the system description, and the exceptions noted against individual controls. Buyers comparing a SOC 2 report against an ISO 27001 certificate should also note the two prove different things; one is a tested opinion over a period, the other is a point-in-time certification against a management system standard. SOC 2 vs ISO 27001: what to ask vendors for covers when to ask for one, the other, or both.

Common mistakes that stall or undermine a Type II report

Vendors chasing a fast Type II timeline for a specific deal tend to make the same mistakes: starting the observation window before controls are actually operating, scoping out the product the buyer actually uses, or letting the report period lapse without publishing a bridge letter or scheduling the next audit. The pattern shows up repeatedly across vendor evidence pages.

6 to 12 months

typical Type II observation window length

common audit practice; always confirm the stated dates inside the report itself

1 of 5

Trust Services Categories that is mandatory: security

AICPA Trust Services Criteria

2026-11-05

snapshot date this article's framework and field guidance reflects

in the CertReports index