SOC 2 request response
A customer asked for SOC 2 and we do not have it—what should we send?
Who this guide is for
B2B SaaS founders, CTOs, sales engineers, operations leaders, and security owners responding to a live customer SOC 2 request.
Key takeaways
- State the absence of SOC 2 directly.
- Ask whether SOC 2 is mandatory or one acceptable form of assurance.
- Offer evidence matched to the buyer's underlying risk questions.
- Separate current controls from roadmap commitments.
- Never describe a scan, policy pack, or pentest as equivalent to SOC 2.
Start with the exact truth
Say whether the company has no SOC 2 engagement, has one planned, or has an engagement in progress. If work is in progress, share dates only after the responsible owner and audit firm have validated them. Avoid phrases such as ‘SOC 2 ready’ unless the meaning and evidence are explicitly defined.
Find the requirement behind the request
Ask whether the buyer's policy requires a current SOC 2 Type 1 or Type 2 report, or whether it needs evidence for specific controls such as access, incident response, resilience, secure development, or vulnerability management. An alternative package is useful only if the buyer is permitted to evaluate it.
Build a bounded alternative package
Offer a concise security overview, architecture and data-flow summary, completed questionnaire, relevant policies or evidence index, current independent or external assessment summary, penetration-test executive summary if one exists, and remediation status. Label the date, owner, scope, confidentiality, and limitations of every artifact.
Protect the deal from accidental promises
Do not let sales invent an audit date, certification claim, remediation deadline, or contractual control. Route commitments through the accountable security, engineering, legal, and business owners. Record what was sent and every follow-up obligation.
Decide whether SOC 2 is now commercially necessary
If qualified buyers repeatedly treat SOC 2 as a hard gate, quantify the affected pipeline and evaluate a formal readiness and examination program with qualified advisors. One urgent request should trigger a decision, not an unsupported assurance claim.
What to offer—and what each item cannot prove
| Available artifact | Useful for | Important limitation |
|---|---|---|
| Security overview and questionnaire | Explaining current controls and ownership | Self-described evidence is not an independent examination |
| External security posture report | Showing time-bound, publicly observable conditions | Cannot validate internal control design or operation |
| Penetration-test executive summary | Showing scoped technical testing and remediation status | Does not cover the full SOC 2 control environment |
| Policies and operating records | Supporting specific control answers | A policy alone does not prove consistent operation |
| Approved SOC 2 roadmap | Explaining a funded, owned future program | A plan is not a completed report |
Copy-ready customer response
Use only after the security and commercial owners approve the facts
We do not currently have a SOC 2 report. We do not want to misrepresent another assessment as equivalent.
To support your review, we can provide our current [security overview/questionnaire], [assessment or pentest summary if applicable], relevant customer-safe control evidence, and the remediation status for material findings. Each artifact includes its scope, date, and limitations.
Could you confirm whether a current SOC 2 [Type 1/Type 2] report is a mandatory approval condition, or whether your security team may evaluate alternative evidence for the specific controls in scope? We can then route the correct package and arrange a focused follow-up with the responsible owner.Recommended workflow
- Confirm whether SOC 2 is a hard requirement.
- State your current assurance status accurately.
- Map the buyer's control questions to current evidence.
- Share only approved customer-safe artifacts.
- Record remaining gaps, owners, and the next decision.
Use the worksheet
Turn the guide into an owned process.
Open the printable checklist for this topic, assign the missing owners, and record the evidence or decision behind every completed item.
Open printable checklistFrequently asked questions
Can a pentest replace SOC 2?
No. A pentest supplies scoped technical-testing evidence; SOC 2 is a separate independent examination of controls relevant to selected Trust Services Criteria.
Should we promise a SOC 2 completion date?
Only if the program owner and qualified provider have approved a realistic date. Do not turn a sales estimate into a customer commitment.
What if the buyer says SOC 2 is mandatory?
Escalate the commercial decision. The buyer may reject alternatives, change scope, apply an exception, or delay approval; your team should not claim compliance it does not have.
Sources and further reading
This guide provides general operational information. It is not legal advice, a certification, or a substitute for a qualified security assessment scoped to your organization.