SOC 2 Type II requires an auditing firm to continuously verify over an observation period (usually 6 to 12 months) whether the service provider's controls for security, availability, processing integrity, confidentiality and privacy actually operate as designed.