Audit and compliance
Observation window
Also called: audit period, review period, SOC 2 window
The observation window is the period a SOC 2 Type II report covers, typically three to twelve months, during which controls must be shown to have operated effectively.
Testing evidence has to be dated inside the window to count for it. This is the single most common scheduling mistake in a first Type II: a penetration test performed before the window opens does not evidence the window.