Can we say we are working toward SOC 2?

Yes, when it is true and there is a plan behind it. A sentence such as "We do not hold a SOC 2 report. We plan to engage a CPA firm for a Type I report by [month]" is accurate. Give a date only when an engagement is booked or you can stand behind the plan, and update the answer when the date moves.

Should I leave a question blank if the honest answer is no?

No. A blank leaves the reviewer guessing, and it usually triggers a follow-up email. A short, accurate "No, not yet" with a plan reads better than silence, and it protects you if the answer is later relied on. Outside guidance on questionnaires makes the same point: pair every No with a remediation plan.

Is a SOC 2 report the same as a certificate?

No. A SOC 2 report is an attestation written by a licensed CPA firm after it examines your controls. There is no SOC 2 certificate. If a questionnaire asks for a certificate or certification, answer with your actual status and name the report you do or do not hold.

Do written policies count as evidence if we have no report?

They show what you require, not that a control operates. Customers often accept policies and a completed questionnaire for an interim period, but only the customer can say whether it is enough. Ask them directly, and attach only policies you have adopted and follow.

What if the customer says they will not proceed without the report?

Ask what they will accept in the meantime and by when they need the report. Some will take a Type I report first or a dated plan; some will not. Our guide for when a customer asks for your SOC 2 report covers the questions to ask them and a first plan.

How do I stop answering the same questions again and again?

Keep one master set of reviewed answers, each with the evidence behind it, and copy from it into every new questionnaire. Review it on a schedule and whenever a control changes, so the answers stay consistent across customers.

How to answer a security questionnaire without a SOC 2 report

Updated 25 October 2026

Answer the questions you can answer truthfully, say plainly that you do not hold a SOC 2 report, and attach the documents that back each answer instead: written policies, an incident response plan and a security page. Where a control is partial or missing, write "not yet" with a plan and a date you can meet. Never answer "yes" to something you cannot show, and never leave the report question blank. This guide gives example wording for the questions that ask for a report, and covers what to attach, which answers add contract risk, and how to keep a reusable answer set.

Why a missing report does not have to end the review

A SOC 2 report is an attestation from a licensed CPA firm, and you cannot produce one on request. A questionnaire is something else: a self-assessment the customer asks you to complete. Secureframe notes that a report can often replace or speed up a questionnaire, but that it is not always enough, so the practical advice is to ask each customer which form of assurance it accepts (see Secureframe on SOC 2 versus questionnaires). The reverse also holds: without a report, a complete and honest questionnaire is often what a reviewer works from.

Decryption Digest's guidance on vendor questionnaires says to state plainly that you do not hold the report, say where you are, and offer interim documents (see Decryption Digest on responding to vendor questionnaires). If the customer has also asked for the report itself, start with what to send when a customer asks for your SOC 2 report; this guide goes deeper on the questionnaire answers.

The questions that ask for a report, and honest answers to each

Four questions come up in almost every questionnaire. The wording below is example wording to adapt, not text to paste. Each answer is true only if the facts in brackets are true for you. Replace every bracket, delete any sentence that is not accurate today, and keep the evidence for each statement.

"Do you have a SOC 2 report?"

No. We do not currently hold a SOC 2 report. We have adopted written security policies covering [list the areas, for example access control, encryption, incident response and vendor management], which we can share on request. [If true: We have engaged a CPA firm for a Type I report with an expected issue date of [month]. / If not yet engaged: We plan to begin the engagement in [quarter].] We will provide the report under NDA when it is issued.

Give a date only if an engagement is booked or the plan is one you will keep. If you cannot yet commit to one, leave it out. The structure follows the advice above: your status, what you have now, what comes next.

"Do you perform penetration tests?"

[If you have had one: Yes. Our most recent independent penetration test was performed by [provider] in [month, year]. We can share an executive summary under NDA.] [If you have not: Not yet. Our Vulnerability and Patch Management Policy requires an independent penetration test at least annually, and our first test is scheduled for [month, year]. In the meantime we run [dependency and container scanning, secret scanning, and so on, only the tools you actually run].]

Wolfia's guidance warns that an outdated detail, such as an old penetration test date, undermines the credibility of the rest of the answers (see Wolfia on the anatomy of a security questionnaire answer). If you are planning your first test, the penetration test scope template helps you get comparable quotes.

"Is customer data encrypted at rest?"

Yes. Production databases, object storage, volumes and backups on [your cloud provider] are encrypted at rest with [AES-256 or the provider's equivalent], using keys held in the provider's key management service. [Evidence: the provider's encryption settings, which we can show on a call.] Our Encryption and Key Management Policy sets this as a requirement.

Only answer "yes" for the stores you have checked. If one store, such as a log bucket, is not encrypted yet, say which one and when it will be.

"Is multi-factor authentication required for all employees?"

Partly today. Multi-factor authentication is required for all administrative accounts and for access to [cloud provider, source control and customer data]. We are extending it to every workforce account by [date], and we export enrollment status monthly to track the rollout.

This is the pattern to copy for any partial control: what is in place now, what is not, and a date. Decryption Digest suggests treating every answer as one of three kinds: a Yes with an evidence path, a No with a remediation plan, or an N/A with a reason. For the formal questionnaires, it also says maturity answers such as "partially implemented" are legitimate.

The free answer library has 157 questions in this style. Each answer cites the policy it comes from and leaves a marked placeholder wherever only you know the fact, such as report status or the date of your last test.

What to attach instead of a report

Written policies you have adopted. The Access Control Policy, Encryption and Key Management Policy and Vulnerability and Patch Management Policy answer a large share of the technical questions. The free generator renders all 22 from 23 questions in your browser.
An incident response plan. The incident response plan template and the Incident Response Policy show who does what and when customers are told.
A security page. The trust page generator builds one that states only what you tick, so a reviewer can read your hosting, encryption and contact details before they send follow-ups.
A penetration test summary, if you have one. Offer an executive summary under NDA; do not attach a full report unless you are comfortable with it leaving the building.
Vendor reports for your own providers. Pointing to your cloud provider's report covers the provider's controls, not yours. Say so explicitly (see where to get vendor reports).

Answers that create contract risk

Customers rely on questionnaire answers and often attach them to the contract. Decryption Digest points out that a false "yes" creates misrepresentation risk, and that accurate answers with remediation plans usually serve procurement better than answers nobody can verify. The patterns to avoid:

A "yes" you cannot support. If you cannot show it, it is a "no" or a "partly".
A blank or "see attached" with nothing attached. A reviewer reads silence as either a gap or evasion, and it invites a call.
Borrowed status. Do not describe your cloud provider's report as yours, and do not use the words "SOC 2" in a way that suggests a report you do not hold.
Promised dates you do not control. A date tied to a booked engagement is safer than a hope.
Absolute words. "All", "every" and "never" turn a small exception into a false statement. Prefer "required by policy for" and name the scope.

Keep answers consistent across sections

Questionnaires ask the same thing several ways: MFA appears under access control, remote work and administration; encryption under data protection and backups. Decryption Digest warns that inconsistency is a red flag for experienced procurement teams, and Wolfia advises using the same scope language and terms across related answers. Before you send, search your draft for each of these topics and make sure the answers agree: report status, the date of your last penetration test, MFA coverage, which environments are in scope, and the list of subprocessors.

Build a reusable answer set

Answer once, then reuse. Decryption Digest recommends a master library of accurate answers, with the evidence path for each Yes, the compensating control for each partial answer and the timeline for each No, reviewed quarterly or whenever a control changes. You can start from these:

The free draft answers tool answers the 35 questions of our standard vendor template from your saved generator answers and marks what only you can fill in.
The answer library has 157 questions to search, copy from, and download as XLSX or Markdown.
When the customer sends their own spreadsheet, the questionnaire tool drafts answers from your policies, up to 150 questions per questionnaire, citing the policy statements and flagging what needs your input. It is included with the Audit Kit ($59), or on its own as the Questionnaire Pack ($19). See questionnaire formats for how CAIQ, HECVAT and SIG files are handled.

Whichever you use, a draft is only a draft. Read every answer, fill every placeholder, and delete any statement that is not true today.

When the questions keep coming: start the SOC 2 project

If a second or third customer has asked, a report starts to pay for itself in sales time. Write down what you have so far: the policies, a baseline from the SOC 2 readiness assessment, and dates from the SOC 2 timeline planner. Then talk to CPA firms. The customer-asked guide has a first plan scaled to a small team.

Frequently asked questions

How do I answer a security questionnaire without SOC 2?: State your status plainly (no report yet), answer every other question from what you actually do today, and attach the documents that back each answer: your written policies, an incident response plan, and a security page. Where a control is partial or missing, say so and give the plan and a date you can meet. Send nothing you cannot support, because customers rely on these answers and may write them into the contract.
Can we say we are working toward SOC 2?: Yes, when it is true and there is a plan behind it. A sentence such as "We do not hold a SOC 2 report. We plan to engage a CPA firm for a Type I report by [month]" is accurate. Give a date only when an engagement is booked or you can stand behind the plan, and update the answer when the date moves.
Should I leave a question blank if the honest answer is no?: No. A blank leaves the reviewer guessing, and it usually triggers a follow-up email. A short, accurate "No, not yet" with a plan reads better than silence, and it protects you if the answer is later relied on. Outside guidance on questionnaires makes the same point: pair every No with a remediation plan.
Is a SOC 2 report the same as a certificate?: No. A SOC 2 report is an attestation written by a licensed CPA firm after it examines your controls. There is no SOC 2 certificate. If a questionnaire asks for a certificate or certification, answer with your actual status and name the report you do or do not hold.
Do written policies count as evidence if we have no report?: They show what you require, not that a control operates. Customers often accept policies and a completed questionnaire for an interim period, but only the customer can say whether it is enough. Ask them directly, and attach only policies you have adopted and follow.
What if the customer says they will not proceed without the report?: Ask what they will accept in the meantime and by when they need the report. Some will take a Type I report first or a dated plan; some will not. Our guide for when a customer asks for your SOC 2 report covers the questions to ask them and a first plan.
How do I stop answering the same questions again and again?: Keep one master set of reviewed answers, each with the evidence behind it, and copy from it into every new questionnaire. Review it on a schedule and whenever a control changes, so the answers stay consistent across customers.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.