Six-Month Deadline for a First Type II
Tessera Analytics is a 42-person startup selling a workforce analytics SaaS. A Fortune 500 prospect will not sign until it receives a SOC 2 Type II covering Security and Availability. The prospect's deadline is 30 June, six months away. Tessera has no formal risk assessment; change management is performed through GitHub pull requests with one approval, but there is no evidence of testing; there are no background checks; annual security training is delivered ad hoc; the SLA is 99.5% and appears on the website but not in the customer contract; and there is a single production environment in a public cloud. The CTO proposes to 'do a Type II for the last three months before the deadline' and to exclude Availability because the SLA is not in the customer contract. The sales team wants a report by 30 June. An advisor suggests a Type I first.
1. Evaluate the proposed three-month Type II and the exclusion of Availability.
Read the worked answer
A Type II report can cover a period shorter than 12 months, but the period must be long enough to demonstrate operating effectiveness. Three months is not automatically invalid, but it limits the evidence and may not satisfy a Fortune 500 procurement team that expects a 12-month report. More importantly, the controls must actually operate throughout the period. Tessera currently lacks a risk assessment, background checks, and change-testing evidence, so a three-month window starting soon would capture a remediation period, not a stable control environment. The report would state the short period, and the prospect may reject it.
Availability is a separate judgement. The website SLA is a public commitment, even if it is not in the signed contract, and customers may rely on it. Excluding Availability may be defensible if there is no contractual commitment and management does not want to assert availability objectives, but the sales team should confirm the prospect's expectations first. If Tessera includes Availability, it needs monitoring, capacity management, incident response, and SLA reporting. If it excludes Availability, the report should not imply that availability commitments are covered.
2. Sequence the readiness work and decide between a Type I, a Type II, or both.
Read the worked answer
The first step is a gap analysis against the Security common criteria, with Availability added if the prospect requires it. The gap analysis should produce a remediation plan with owners and dates: formal risk assessment, background checks, security training with completion evidence, change management with testing and approval evidence, vendor risk management, and incident response testing. Policies alone will not close the gaps; the controls need to operate and leave evidence.
A Type I can be issued as of a date once the design is in place. It gives the prospect a point-in-time opinion on the fairness of the description and suitability of design, but it does not show operating effectiveness over a period. A Type II should follow after the remediated controls have operated long enough to test. The advisor's suggestion is reasonable if the prospect will accept a Type I plus a plan for a Type II. If the prospect will not, Tessera should negotiate the deadline rather than promise a Type II it cannot support. The observation period should be agreed with the auditor and should not be shortened just to hit a sales date.
3. What should management tell the prospect and the sales team now?
Read the worked answer
Management should tell the prospect the truth about the current state: no SOC 2 report exists yet; a readiness assessment is underway; a Type I may be available by a stated date; and a Type II will follow after controls have operated for an agreed period. It should ask the prospect whether a Type I plus a bridge plan is acceptable, or whether a shorter Type II is acceptable, and get that in writing. Sales should stop saying 'SOC 2 Type II by 30 June' until the auditor confirms the timeline.
The commercial message can still be positive: Tessera is investing in controls, has engaged an auditor, and will provide a readiness letter and evidence of remediation. If the prospect requires a report as a condition of signing, management should consider a contractual commitment with a realistic date and consequences. Promising a report that does not exist is a misrepresentation risk and can damage the relationship more than a candid timeline.