A SOC 2 report does not have a fixed expiration date like a certification – rather, it is intended to be read as a report over a certain date or time period.