How long is a SOC 2 report valid?
People often say "twelve months". That's a simplification. Nothing in the AICPA's standards gives a SOC 2 report an expiry date. A Type 2 report says your controls worked from one date to another, and that stays true forever.
The report does get less useful. It says nothing about what happened after the period ended, and the further back that date is, the less a customer can rely on it. Most security teams stop accepting a report once its period ended more than about a year ago. That habit is where the 12-month rule of thumb comes from.
How often is a SOC 2 audit required?
Once a year, by market convention. After your first Type 2, the usual pattern is a 12-month period that begins the day after the previous one ended. That gives you continuous coverage with no gaps.
A gap is worth avoiding. If one report ends in June and the next period starts in September, a careful reviewer will ask what happened in July and August.
What is a SOC 2 bridge letter?
Reports always arrive late. A period that ends on 31 December typically produces a report four to eight weeks later. Meanwhile your newest report describes a period that's already over, and a customer may be asking for assurance about today.
A bridge letter fills that gap. It is a short letter on your letterhead, signed by your management, that says:
- which report it relates to, and the period that report covered;
- that there have been no material changes to the control environment since that period ended, or what has changed;
- when the next report is expected.
Two things people get wrong. First, your auditor doesn't write or sign it, so it carries no independent assurance. Second, it's meant for short gaps. The convention is up to about three months. If you need to cover much more, it's time for a new audit.
What a renewal year looks like
This is an example calendar for a period that runs January to December. Pick a month.
The renewal year, month by month
Jan: New period starts the day after the last one ended. Write a bridge letter if customers need one. Start the annual risk assessment.
These cadences are common practice. SOC 2 does not mandate them. Whatever your policies promise is what the auditor will test.
What changes in year two
- The period is longer. A first report can cover three months. Renewals normally cover twelve.
- Last year's exceptions are remembered. The auditor will look at whether you fixed what they found.
- Change shows up. New products, new vendors, a new cloud region and staff turnover all land in the system description.
- Sampling gets broader. Twelve months of hires, leavers and code changes means more samples.
What does a SOC 2 renewal cost?
Less than year one. Published estimates put ongoing annual cost at $15,000 to $40,000 for a small company, or roughly 40 to 70 percent of the first year. The audit fee, the platform and the pen test recur. The readiness assessment, the policy writing and most of the remediation don't.
What can push it back up: adding criteria, adding a framework, or changing auditor and paying for them to learn your system.
How renewals go wrong
- The quarter nobody did the access review. It can't be backdated, and it becomes an exception.
- A gap between periods because the auditor was booked late.
- Leavers who kept access. A very common finding, and easy to prevent with a checklist.
- Policies nobody re-approved. Annual means annual.
- The compliance owner left and the calendar left with them.
With AccuSights: evidence keeps collecting itself between audits, every control is watched all year, and your engineer flags the quarterly tasks before they're late. Next year's audit becomes a renewal and not a rerun.