How long is the SOC 2 Type 2 reporting period?

This will depend on whether you are undergoing an initial or subsequent SOC 2 audit.  For an initial SOC 2 audit, there is a degree of flexibility in the reporting period.  Ideally, your initial reporting period will be 12 months, as a longer period provides greater assurance.   However, if you do not have 12 months’ worth of evidence to provide to your auditor, shorter reporting periods are also acceptable.  It will need to be long enough that operational effectiveness can be demonstrated and validated, and 3 months is typically the shortest reporting period that CPA firms will accept.  A 6-month reporting period for an initial report is also common.  

SOC 2 auditing is generally an annual process, with SOC 2 reports being considered ‘valid’ for 12 months.  As such, once you have your initial report in place, subsequent reports will need to be produced 12 months afterwards, covering the 12 months since your previous audit, and clients will expect there to be no gaps between reports.