Month 1: Lock In the Observation Period Start

Confirm the official start date with your auditor — typically the day after your Type I report closes. Verify that every control in your control inventory is actually operating, not just documented. Assign owners to each recurring process: access reviews, vulnerability scans, IR tabletop, DR test. If you don't have continuous evidence collection running, start it now. You need timestamped configuration snapshots from day one of the observation period — not assembled retroactively.

Month 2–3: Execute the First Recurring Controls

By month three you should have: first quarterly access review completed and documented in your ticketing system, two rounds of vulnerability scanning on record, at least one documented GuardDuty finding review, and evidence that change management controls operated on real production deployments. These are your first data points for the Type II evidence set.

Month 4: Mid-Period Internal Audit

At the midpoint, run a mini internal review. Walk through every control in your inventory: is it operating? Is evidence being captured automatically or manually? Any gaps? If you find a control failure — a missed access review, an encryption misconfiguration that slipped through — remediate it immediately and document the remediation. Auditors understand that controls occasionally fail in a twelve-month period; what they look for is that failures were detected and corrected promptly.

Month 5: Organize the Evidence Package

Your auditor will request samples from throughout the observation period — not just the most recent month. Begin organizing evidence by control category: access reviews with reviewer names and outcomes, CloudTrail completeness verification across all regions, GuardDuty finding reviews, deployment records showing change management, policy acknowledgment logs. SecureSpect automatically organizes evidence by control in the auditor portal — if you've been running it through the observation period, this step is a click.

Month 6: Fieldwork and Report

Engage your auditor for fieldwork. Provide an updated system description. Designate an audit liaison who manages all incoming requests — fragmented responses through multiple Slack channels add weeks to the process. Respond within two business days to every auditor request. Expect three to six weeks of fieldwork, then four to eight weeks to report issuance.