What do I say instead of "SOC 2 certified"?

Name the report, its type, the firm and the period: "We have a SOC 2 Type II report from [CPA firm] covering [start date] to [end date], available under NDA." Add the Trust Services Criteria in scope if you like. If you do not have a report yet, say what is true today, such as "we are preparing for a SOC 2 Type II examination."

Is it wrong to say we passed SOC 2?

It is imprecise. A SOC 2 report is not a pass or fail grade. The auditor gives an opinion, and the report lists any exceptions the auditor found. Vanta says there is no official certifying body or pass/fail status for SOC 2. Describe what you received, such as an unqualified opinion on a Type II report, and only if that is what the report says.

Can I put a SOC 2 badge or logo on my website?

A badge is a design choice, not a status. Check your report and your auditor's terms before you use any AICPA mark, and keep the wording next to it accurate: the report type, the period and a note that the full report is available under NDA. A logo with no wording around it invites the reading that you hold a certificate.

How do I describe our status while the audit is still running?

State the facts and leave out the outcome. For example: "Our SOC 2 Type II observation period began on [date]. We expect the CPA firm to issue the report in [month]." The auditor sets the issue date, so treat your own estimate as an estimate. Do not describe the report as received until you hold it.

Is ISO 27001 a certification?

Yes. Drata describes ISO 27001 as an international standard that results in a certificate issued by an accredited certification body, valid for a defined term. SOC 2 differs in kind: a CPA firm examines your controls and issues a report, not a certificate. The two are not interchangeable in a contract, so use the right noun for each.

What does Policyseed do about this wording?

The free policy checker flags sentences that claim a certification or an outcome the auditor has not given, and suggests rewrites. The generator and the Audit Kit write policies, not claims about your status. The CPA firm performs the examination and forms its own opinion, and Policyseed is not a CPA firm and not affiliated with the AICPA.

Is SOC 2 a certification? How to describe your report

Updated 25 October 2026

No. SOC 2 is not a certification. It is an attestation report, written by a licensed CPA firm under AICPA standards, that describes your system and gives the auditor's opinion on your controls. There is no certificate to frame, no "SOC 2 certified" status and no central registry of companies that hold one. What you have, after an examination, is a report. So the accurate sentence is "we have a SOC 2 Type II report covering [period], available under NDA." The wording matters because customers, auditors and contracts read it literally.

Short answer: an attestation report with an auditor's opinion

The AICPA, the body that sets the professional standards for SOC engagements, describes SOC as a suite of services that CPAs may provide, and says CPAs use them to issue assurance reports (AICPA). A SOC 2 report is one of those reports. It covers the controls of a service organization against the Trust Services Criteria, and only a CPA firm can issue it. Vanta puts the consequence plainly: the AICPA designs the SOC 2 standards but does not grant certifications, and there is no official certifying body or pass/fail status for SOC 2 (Vanta).

That is why the report is the proof, not a badge or a letter from a vendor. Software, templates and consultants can prepare you for the examination, but none of them can issue the report. The report has the auditor's name on it, and it is the document a customer's security team reads.

The four opinions a SOC 2 report can carry

Because the report contains an opinion, it is not a pass or a fail. Scytale describes four kinds (Scytale):

Unqualified. A clean report. Controls are designed and operate as intended, with no significant issues.
Qualified. Many controls work, but the auditor found notable exceptions.
Adverse. The auditor finds the controls not effective overall, with significant and pervasive deficiencies.
Disclaimer. The auditor could not obtain enough evidence to form an opinion, often because of scope limits or uncertainties.

So "we have a SOC 2 report" says less than it seems to. Which opinion, over what period and on which criteria is what a careful reader asks next. Drata makes the same point about exceptions: a report can list them without the result being a binary failure (Drata). Do not claim an opinion your report does not contain.

Type I and Type II in one paragraph

A Type I report covers whether your controls are suitably designed on one date. A Type II report also covers whether they operated effectively over a period, which Drata gives as typically 6 to 12 months (Drata). Always name the type and the date or period in anything you publish, because "SOC 2" alone could mean either. See Type I vs Type II for what each needs from your policies.

Wording you can defend

Use the same pattern at every stage: the report, its type, the CPA firm, the period, and how a customer gets it. Leave out any word that sounds like a grade or a certificate.

Say this	Not this
We have a SOC 2 Type II report covering [start] to [end].	"We are SOC 2 certified."
Our report is available under NDA on request.	A "SOC 2 certificate" to download.
A licensed CPA firm issued an unqualified opinion. (Only if true.)	We passed SOC 2.
We are preparing for a SOC 2 Type II examination.	We are SOC 2 ready.

Before an audit

Say what exists. You have written policies, a plan and perhaps a booked CPA firm. You do not have a report, so do not use the report's name as if you did. For example:

We do not hold a SOC 2 report yet. We have written security policies and plan to engage a CPA firm by [month] for a [Type I / Type II] report. Our security overview is at [link], and we will share the report under NDA when it is issued.

The customer-asked guide covers the full reply, and the trust page generator builds a security page that states only the items you tick.

During the observation period

The examination is in progress, and the auditor, not you, decides what the report says and when it is issued. State the start of the period and an expected month, and mark it as an expectation.

Our SOC 2 Type II observation period began on [date]. We expect the CPA firm to issue the report in [month].

After the report

Name the report as received, and give the facts a security team needs to read it.

We have a SOC 2 Type II report from [CPA firm] covering [start date] to [end date] on the [Security, and other criteria in scope] criteria. It is available under NDA at [contact].

Vanta's suggested headline for announcing it follows the same shape: it names the report type, and recommends the term "attestation report" for the document (Vanta). A report covers a stated period, so when months have passed since it ended, a bridge letter is the management letter that speaks to the time since.

Why the wording matters in sales and contracts

A customer's reviewer reads your claim, then asks for the document that proves it. If you wrote that you hold a certificate and the document is a report with a qualified opinion, the gap is yours to explain. In a contract the risk is larger. A clause that promises you will "maintain a SOC 2 certification" commits you to something that does not exist. Prefer wording that names what you can deliver, such as a SOC 2 Type II report issued by an independent CPA firm, on a schedule you control, and agree who gets the report and under what NDA. If a contract uses the wrong noun, ask for it to be changed before you sign.

Why ISO 27001 is different

ISO 27001 is a certification. Drata describes it as an international standard that results in a certificate from an accredited certification body, valid for a defined term, and focused on an information security management system (Drata). SOC 2 is a CPA firm's report on service organization controls. If a customer asks for one and you hold the other, say so directly, because the two do not substitute for each other in a contract. The SOC 2 to ISO 27001 mapping shows how the controls overlap, and SOC 2 vs ISO 27001 covers which to pursue first.

Check your own pages and policies for overclaims

Search your website, security page, sales decks, questionnaire answers and policies for the phrases in the right-hand column above. They creep in through marketing copy, old RFP answers and policy text written to sound reassuring. A policy that says the company holds a certificate is a statement of fact that an auditor will test and a customer may rely on.

The free policy checker does this for you: paste your policies or drop in the Word files, and it flags sentences that claim a certification or an outcome, with a suggested rewrite. It runs in your browser. For a wider baseline, the readiness assessment gives a score and a gap list in a few minutes, and the generator writes the 22 policies from 23 questions with no signup.

If you want a complete folder instead, the Audit Kit ($59, one time) puts the 22 policies in your company's name as editable Word files, and the Agency license ($199, one time) covers up to five companies. Neither replaces the CPA firm's examination or issues a report.

Frequently asked questions

Is SOC 2 a certification?: No. A SOC 2 report is an attestation report written by a licensed CPA firm under AICPA standards. It describes your system and gives the auditor's opinion on your controls. There is no certificate, no pass or fail status and no central registry that lists companies. Say that you have a SOC 2 Type II report covering a stated period, and offer it under NDA.
What do I say instead of "SOC 2 certified"?: Name the report, its type, the firm and the period: "We have a SOC 2 Type II report from [CPA firm] covering [start date] to [end date], available under NDA." Add the Trust Services Criteria in scope if you like. If you do not have a report yet, say what is true today, such as "we are preparing for a SOC 2 Type II examination."
Is it wrong to say we passed SOC 2?: It is imprecise. A SOC 2 report is not a pass or fail grade. The auditor gives an opinion, and the report lists any exceptions the auditor found. Vanta says there is no official certifying body or pass/fail status for SOC 2. Describe what you received, such as an unqualified opinion on a Type II report, and only if that is what the report says.
Can I put a SOC 2 badge or logo on my website?: A badge is a design choice, not a status. Check your report and your auditor's terms before you use any AICPA mark, and keep the wording next to it accurate: the report type, the period and a note that the full report is available under NDA. A logo with no wording around it invites the reading that you hold a certificate.
How do I describe our status while the audit is still running?: State the facts and leave out the outcome. For example: "Our SOC 2 Type II observation period began on [date]. We expect the CPA firm to issue the report in [month]." The auditor sets the issue date, so treat your own estimate as an estimate. Do not describe the report as received until you hold it.
Is ISO 27001 a certification?: Yes. Drata describes ISO 27001 as an international standard that results in a certificate issued by an accredited certification body, valid for a defined term. SOC 2 differs in kind: a CPA firm examines your controls and issues a report, not a certificate. The two are not interchangeable in a contract, so use the right noun for each.
What does Policyseed do about this wording?: The free policy checker flags sentences that claim a certification or an outcome the auditor has not given, and suggests rewrites. The generator and the Audit Kit write policies, not claims about your status. The CPA firm performs the examination and forms its own opinion, and Policyseed is not a CPA firm and not affiliated with the AICPA.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.