Securing Your
Observation Window

The observation window is the period — typically 3–12 months — during which your auditor examines whether your security controls operated effectively. Unlike a Type I audit (point-in-time assessment), Type II requires documented evidence that controls functioned continuously throughout the entire observation window. Most organizations use a 6-month or 12-month observation window. Your readiness toolkit must demonstrate that controls were in place AND operating throughout that window — not just at the start or end.

The five TSCs are: Security (common criteria — required for all audits), Availability (uptime and resilience guarantees), Processing Integrity (accurate, complete data processing), Confidentiality (data classification and access controls), and Privacy (PII collection and handling). Most SaaS companies use Security + Availability + Confidentiality. Processing Integrity applies to payment processors and data processing services. Privacy applies only when you collect and process personal information under the GDPR/CCPA/privacy principles framework. Your audit report will specify which TSCs are in scope.

A readiness assessment is a self-run gap analysis before you engage an auditor — it identifies which controls are missing, incomplete, or lack supporting evidence. An audit is the formal examination by an independent CPA firm that results in a published opinion. The readiness phase is where you find and fix gaps at minimal cost. The audit phase is where you demonstrate compliance. This toolkit is a readiness tool — it helps you run an internal audit simulation so that when the real auditor shows up, your evidence is organized, your controls are operational, and your team knows what to expect.

Auditors request: (1) policies and procedures — written documents showing what controls should do; (2) supporting evidence — logs, screenshots, configuration records, access reviews, training completion records, vendor assessments, incident response records; (3) consistency — evidence that controls operated throughout the observation window, not just on a single date. Common gaps: missing access review evidence (most common), incomplete vendor assessments, no incident response test records, and training completed but not tracked in a system the auditor can access. This toolkit's evidence matrix maps each control to the specific evidence type you need.

Most organizations need 3–6 months of lead time before their observation window begins. Larger or more complex organizations (100+ employees, complex vendor ecosystem, multiple TSCs in scope) may need 6–12 months. The gap checklist in this toolkit should take one week to complete with your security team. Closing gaps takes 1–3 months depending on severity. The last month before the audit window begins should be spent ensuring all monitoring controls are operational and documented. Attempting to compress this timeline is the leading cause of audit failures.

Lack of evidence — not lack of controls. Most organizations have the right policies and procedures in place, but cannot demonstrate that the controls operated consistently throughout the observation window. Specific common failures: access reviews performed but not documented, change management procedures followed but not logged, vulnerability scans run but results not reviewed, security training completed but not tracked in a system that produces an audit report. The evidence matrix in this toolkit (Page 5) maps each TSC control to the specific evidence artifact you need, so you're not guessing at audit time.