What should I do when a customer asks for a SOC 2 report and we don't have one?

Reply the same week, and say plainly that you do not hold a report yet. Ask which report type they need, by when, and whether a completed security questionnaire and your written policies will do in the meantime. Then send what you can stand behind today: the policies, questionnaire answers, and a short status note with the month you plan to engage a CPA firm.

Can we send our security policies instead of a SOC 2 report?

Often as an interim step, but only the customer can say whether it is enough. Many security reviews accept written policies plus a completed questionnaire while the report is in progress, especially for smaller contracts. Ask the reviewer directly, and keep their answer in writing, because it tells you whether the deal waits for the report or not.

Is a SOC 2 report the same as a certificate?

No. A SOC 2 report is an attestation report written by a licensed CPA firm after it examines your controls. There is no SOC 2 certificate to frame, and no body that issues one. Customers ask for the report itself, usually under an NDA, and read the auditor's opinion and any exceptions in it.

How long until we can hand the customer a report?

It depends on what is already in place, the CPA firm's schedule and the report type. A Type I report looks at the design of your controls on one date. A Type II report covers an observation period during which the controls must operate, and you agree the length of that period with the firm and, ideally, with the customer. The timeline planner turns your answers into a dated plan with every duration shown as an assumption you can change.

What should we watch for in the contract?

A clause that commits you to deliver a SOC 2 report by a date, or makes the report a condition of renewal or payment. If you agree to one, make the date realistic for your plan, and prefer wording such as "a SOC 2 Type I report within N months of signature" over an open-ended promise.

A customer asked for your SOC 2 report. What to send this week

Updated 25 October 2026

When a customer asks for your SOC 2 report and you don't have one, answer within the week. Say plainly that you don't hold a report yet. Ask what they will accept in the meantime, and send what you can stand behind today: written security policies, answers to their security questionnaire, and a short status note with your plan. Most deals stall on silence, not on a missing report. This guide covers the questions to ask, the package to send this week, and how to plan the audit itself.

What the customer is actually asking for

A SOC 2 report is written by a licensed CPA firm after it examines your controls against the Trust Services Criteria. It comes in two types. A Type I report covers the design of your controls on a single date. A Type II report covers whether they operated over an observation period. You can't produce the report yourself, and a security page or a badge is no substitute for it. What you can produce right away is everything the auditor will later ask for first: written policies, a description of your system and answers to the standard security questions. See Type I vs Type II for what each report needs from your policies.

Five questions to ask the customer before you commit

Which report type do you need, Type I or Type II? The answer changes your timeline more than anything else.
By when? Is the report needed before signature, before go-live or before the first renewal?
Is it in the contract? If so, ask to see the exact clause early.
Will you accept a completed security questionnaire and our written policies in the meantime? Many reviewers will for an interim period.
Who reviews it, and which questionnaire do they use? Their own spreadsheet, the SIG, the CAIQ, or something else (see questionnaire formats).

Write the answers down. They decide whether the deal waits for the report or moves ahead without it.

What you can send this week

Three things, all of which also feed the audit later, so none of the work is wasted:

Written security policies. The free generator renders the 22 policies a SOC 2 examination expects from 23 questions about your company. It runs in the browser with no signup. Review them, adopt the ones that describe what you actually do, and send those. A policy that promises a control you don't run is worse than no policy, because the customer will hold you to it.
Questionnaire answers. The security questionnaire answers tool drafts answers to the 35 standard vendor questions from the same intake, and marks every fact it can't know as needing your input. If the customer sent their own spreadsheet, the Questionnaire Pack ($19) drafts answers to it, grounded in your policies.
A public security page. The trust page generator builds a security page from what is true for you (controls, subprocessors, a contact), as one HTML file you host. Reviewers can link it in their notes.

A status note that doesn't overclaim

Send a short note with the package. Say what is true today and what you plan, and leave out anything you can't evidence. For example:

We do not hold a SOC 2 report today. Our security policies and our answers to your questionnaire are attached. We plan to engage a CPA firm by [month] for a [Type I / Type II] report, and we will share the report under NDA when it is issued. Happy to walk your security team through any of the controls.

Avoid wording that implies a report or an outcome you don't have yet. "Working toward SOC 2" is fine when there is a plan with dates. Claiming a status the auditor hasn't given you can come back during the customer's review or in the contract.

Contract clauses to read before you sign

Look for a commitment to deliver a SOC 2 report on a schedule, a security exhibit that references SOC 2 controls, or a renewal or payment condition tied to the report. If the customer insists on a date, make it a date your plan can meet. Tie it to a Type I if that is what you can deliver first, and get the interim acceptance of policies and questionnaire answers into the same email thread.

Type I first, or straight to Type II

A Type I gives the customer a report sooner and tests your control design before the observation period starts, so problems surface early. Going straight to Type II avoids paying for two examinations when the customer will only accept Type II. Let the customer's answer to the first question above drive this, and confirm it with the CPA firm you engage.

A first plan, scaled to your team

Baseline: take the SOC 2 readiness assessment for a score and a gap list in a few minutes.
Policies: generate, review and approve them, and collect signed acknowledgments (see the acknowledgment guide).
Dates: the SOC 2 timeline planner turns your answers into a week-by-week plan. Every duration is a planning assumption you can change.
Vendors: collect the SOC 2 reports of the vendors that hold your customer data (see where to get them).
Auditor: talk to two or three CPA firms with your scope, team size and the customer's deadline in hand.

If you'd rather start from a complete folder, the Audit Kit ($59, one time) puts the 22 policies in your company's name as editable Word files, tailored to the tools you named. It adds the audit-prep drafts the first conversations with a CPA firm call for: a system description, a gap assessment and a timeline.

Frequently asked questions

What should I do when a customer asks for a SOC 2 report and we don't have one?: Reply the same week, and say plainly that you do not hold a report yet. Ask which report type they need, by when, and whether a completed security questionnaire and your written policies will do in the meantime. Then send what you can stand behind today: the policies, questionnaire answers, and a short status note with the month you plan to engage a CPA firm.
Can we send our security policies instead of a SOC 2 report?: Often as an interim step, but only the customer can say whether it is enough. Many security reviews accept written policies plus a completed questionnaire while the report is in progress, especially for smaller contracts. Ask the reviewer directly, and keep their answer in writing, because it tells you whether the deal waits for the report or not.
Is a SOC 2 report the same as a certificate?: No. A SOC 2 report is an attestation report written by a licensed CPA firm after it examines your controls. There is no SOC 2 certificate to frame, and no body that issues one. Customers ask for the report itself, usually under an NDA, and read the auditor's opinion and any exceptions in it.
How long until we can hand the customer a report?: It depends on what is already in place, the CPA firm's schedule and the report type. A Type I report looks at the design of your controls on one date. A Type II report covers an observation period during which the controls must operate, and you agree the length of that period with the firm and, ideally, with the customer. The timeline planner turns your answers into a dated plan with every duration shown as an assumption you can change.
Should we start with a Type I or go straight to a Type II?: A Type I gives the customer something sooner and tests your control design before the observation period starts. Going straight to Type II avoids paying for two examinations if the customer will only accept Type II. Ask the customer which they accept, then decide with the CPA firm.
What should we watch for in the contract?: A clause that commits you to deliver a SOC 2 report by a date, or makes the report a condition of renewal or payment. If you agree to one, make the date realistic for your plan, and prefer wording such as "a SOC 2 Type I report within N months of signature" over an open-ended promise.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.