Skip to content

Do you need SOC 2 yet? What to send before you have a report

An enterprise customer asked for your SOC 2 report and you don’t have one. What the report is, whether you need it yet, and what to send in the meantime.

By Blank Slate Creative.

OrderFive custom security policies, $85 flat. Markdown, Word, and PDF.

Order the five policies

A customer you want to sign asks for your SOC 2 report. Maybe it is one row in their security questionnaire, maybe it is a clause in the contract draft, maybe it came up on a call. You don’t have one, and you are not sure whether you should.

This guide covers what the customer is asking for, how to decide whether you need a report yet, and what you can honestly send while you don’t have one. One thing first: nothing in this guide, and nothing you send, stands in for a SOC 2 report. If your customer requires one, only a CPA firm’s report meets that requirement. Whether anything else will do for now is your customer’s decision, which is why most of this guide is about asking. It is general information, not legal advice.

What a SOC 2 report is

A SOC 2 report comes out of an examination by a CPA firm. The AICPA, the American Institute of CPAs, publishes the guide to it, and the guide’s title says what is examined: “controls at a service organization relevant to security, availability, processing integrity, confidentiality, or privacy.” Three facts shape your decision.

  • It is an independent CPA’s opinion, not a certificate. The CPA firm that performs the examination issues it; you can’t write one about yourself. What the customer is really asking for is an independent view of your controls.
  • There are two types. In a Type 1 report, the auditor gives an opinion on whether your description of your system “describes what actually exists” and whether the controls in it “are suitably designed.” A Type 2 report adds a second opinion, on whether those controls worked in practice throughout a period you and the CPA firm agree on. So a Type 2 needs controls that have already been running for that period.
  • It is not a public document. Use of a SOC 2 report is generally restricted, so companies share it with customers who ask. The AICPA describes the SOC 3 report as the one that covers the same areas with less detail and “can be freely distributed.”

First, find out what they are asking for

“Do you have a SOC 2?” can mean different things. NIST’s Cybersecurity Framework 2.0, a public framework from the U.S. National Institute of Standards and Technology, describes two things a customer can do about a supplier’s security. The customer may write security requirements for suppliers “into contracts and other types of agreements” (GV.SC-05). Before it signs a supplier, the customer also does “planning and due diligence” (GV.SC-06). A report is one way to do that due diligence; a questionnaire is another. Your customer may not follow this framework at all, but the question is usually one of these:

  • A hard requirement. Their policy or their contract says a vendor handling their data must have a report.
  • A shortcut. A report would save them reviewing you themselves. Without one, they review you another way.
  • A question on a list. One row on a questionnaire, where “No” is an allowed answer.

You can’t tell which from the wording. So ask your contact:

  1. Is a SOC 2 report required before you can sign, or is it one way to complete your review?
  2. If we don’t have one yet, what would you review instead: your questionnaire, a standard one, our security policies?
  3. If a report is required, by when, and which type? Would a Type 1 count at first? Which of the five areas do you need covered?
  4. Is the requirement in the contract? If it is, read that clause before you sign. A promise to deliver a report by a date is a promise you will have to keep.

Write down the answers. They decide the rest of this guide.

Do you need one yet?

No rule decides this, and nothing here is a rule. This is how we would weigh it.

Signs it is time to start:

  • A customer you need says a report is required to sign, and nothing else will do.
  • More than one customer is asking, and they look like the customers you want more of.
  • Your buyers tell you every vendor they use has one.

Signs it can wait:

  • The ask is one row on a questionnaire, and the customer will review you another way.
  • The customer told you that policies and a completed questionnaire are enough for now.
  • Your controls are not running yet, so there would be little for a report to cover.

The last point matters either way. A report describes controls you run. If you can’t yet say who reviews access, how you would handle an incident, or how a change reaches production, the first work is the same whether or not you ever get a report: write the policies, run the controls, and keep the records that show they ran.

What to send while you don’t have one

Send what is true, and label it. In the order we would put it together:

  1. A straight answer. “We do not have a SOC 2 report.” If you have signed with a CPA firm, say so, and say what is agreed: the type and the period. If you haven’t, give no date.
  2. Answers to a questionnaire. Theirs, or a standard one if they will take it. Our guide to SIG Lite and CAIQ-Lite covers the two common ones, and our guide to answering when you don’t have the control covers the gaps.
  3. Your written security policies. Only the ones that are approved and in effect, each with its approval date. Our guide to the first five security policies says which to write first. Before you share an internal document, check whether a confidentiality agreement with this customer covers it.
  4. A short security overview. One or two pages: where you host, how people sign in, how data is encrypted and backed up, what happens in an incident, and who answers security questions. Every sentence true today. Our guide to a security overview document covers what goes in it and what to keep private.
  5. Your plan, only if it is real. What you have decided, who owns it, and by when. A plan you haven’t made is better left out than made up for the email.

What not to send. Three things cost more than they save:

  • “SOC 2 compliant” with no report. The same goes for “SOC 2 ready” and “aligned with SOC 2.” Only a CPA firm’s report says how your controls measure up against the criteria, so without one the phrase tells the customer something nobody has checked.
  • Anything that looks like a report. A readiness assessment or a gap analysis, ours included, is a list of findings, not an examination. Call it what it is.
  • Someone else’s words. Another company’s report or a template’s promises describe controls you may not run.

None of this is a substitute for a report. If the customer requires one, this packet does not change that. What it does is give the customer accurate information to decide with, and give you a file to reuse when the next customer asks.

If you decide to start

The order we would work in:

  1. Scope. Which product or system the report covers, and which of the five areas. As our policies guide explains, the common criteria are all the Security area needs, and which areas go in scope is a decision for you, your customers, and the CPA firm.
  2. Policies. They say what you require of yourself, and an auditor usually tests your controls against them. Write the ones you can follow.
  3. Controls and records. Run what the policies say: access reviews, joiner and leaver steps, change review, incident drills. Keep the record each time.
  4. A readiness check. Compare what you do with the criteria before an auditor does, and fix or document the gaps.
  5. A CPA firm. Agree on the type and the period with them, and check that against what your customer said to question 3.

Do you need a compliance platform? Platforms that track controls and collect evidence are one way to run this work. As we read them, the criteria describe what your controls must achieve, not which tools you use, so a platform is a choice, not a requirement. Weigh it against how much evidence you would otherwise collect by hand. We sell documentation, not a platform, so weigh what we say here with that in mind.

If you would rather hand off the writing

Blank Slate Creative, LLC does readiness and documentation only. We never audit or attest: an independent CPA firm issues any SOC 2 report. This guide draws on public standards and our own judgment, not client work.

  • The five core policies, tailored to your stack. Information Security, Access Control, Incident Response, Acceptable Use, and Data Classification, with the SOC 2 criteria they support cited inline, for a flat $85. Order the five policies, $85.
  • A SOC 2 gap analysis or a criteria map, by quote. A written list of where your documents fall short of the criteria, or a map of your policies to them. Both are documentation, not an examination. Tell us what you need.
  • A person reads your policies. Each custom policy set is read before it is sent to you. We can’t promise that your customer will accept documents in place of a report, or how an examination will go.
  • See it first. The home page has two full sample policies, written for a fictional company. We have no client work to show yet, and would rather say so.

Sources

All read on 2026-10-06.

Related guides

← All guides