Security questionnaire answers › Governance
Do you have a SOC 2 report? How to answer it in a security questionnaire
Why buyers ask this
A SOC 2 report is the shortcut many buyers use to check that controls are designed and operating.
What a strong answer includes
- Answer precisely: Type I or Type II, scope, period, and who the auditor is.
- If you do not have one, say what you have instead and the target date.
- Never imply certification if you hold none. SOC 2 is an attestation report, not a certificate.
Sample answer to adapt
Replace the bracketed parts with your own facts. Only state what is true for your environment.
[We hold a SOC 2 Type II report covering [criteria] for the period [dates], issued by [auditor]; available under NDA.] OR [We do not yet hold a SOC 2 report. We operate controls aligned to the Trust Services Criteria, and our audit is planned for [date]. We can provide our policies, security overview and completed questionnaire in the meantime.]
Evidence to attach
- SOC 2 report (under NDA) or bridge letter
- Security overview
- Policy set
Common mistakes
- Saying 'SOC 2 compliant' without a report.
- Mixing up Type I and Type II.
Answer questionnaires from your own documents
Korrali Trust drafts answers from your policies and evidence so every response traces back to its source, and a person reviews it before it goes out.