If a customer is waiting on a report, start with Type 1. A Type 1 report evaluates whether your controls are designed properly at a single point in time, so you can get one in months. A Type 2 tests whether those controls actually operated over an observation period, usually between three and twelve months, and you can't shorten that period by working harder.
Why I started with Type 1
We were about to lose a customer because we didn't have a SOC 2 report, so we got a Type 1 as fast as we could. It took roughly four to six months, starting from almost no security program. We lost that customer anyway, for other reasons. But another customer had been asking for a third-party audit report for years and had been granting us exceptions in the meantime. The Type 1 ended that. We then went on to three consecutive Type 2 audits, the first with a 12-month observation period, all with zero findings.
The lesson cuts both ways. A Type 1 won't save a relationship that's failing for other reasons. It does turn "we're working on it" into a report the customer can file.
What drives the timeline
Mostly your starting point. Four to six months was the timeline with almost nothing in place. If you already have documented policies, access controls, and some evidence collection, it's shorter. The Type 2 observation period then runs on top of that. Use it to build evidence collection into how you work, not as an end-of-year scramble.
When to go straight to Type 2
If no customer is waiting on you, consider going straight to Type 2. It's the report most enterprise buyers ultimately want, and a Type 1 doesn't count toward the Type 2 observation period. When there is a customer waiting, though, Type 1 first is usually the right call.