SOC 2 Readiness When a Customer Requires the Report
A customer wants your SOC 2 report before they sign. What to send them now, Type 1 vs Type 2, the readiness checklist, and who to hire.
What happens when procurement asks for your current SOC 2 Type 2 report and you don't have one?
The first reflex is to call an audit firm and ask how fast it can go.
But a SOC 2 Type 2 report covers a period of time, so you can't produce one on demand. SOC 2 readiness under a deadline is a sequence. You agree with the customer on what they will accept and by when.
Then you run a readiness assessment, close the gaps and give the customer a new piece of evidence at each stage.
In the ISC2 2025 Supply Chain Risk Survey of 1,062 security professionals, 77% name compliance with standards such as ISO 27001, NIST or SOC 2 as their top vendor requirement. 71% require security audits, attestations or assessments from their vendors.
The cost of a gap is measurable too. Secureframe's 2026 Cybersecurity and Compliance Benchmark Report surveyed 255 people from its own customer community. 47% said a missing certification delayed their sales cycles. 38% lost revenue or a competitive bid for the same reason.
IT Leaders Report 2026
What are your IT peers investing in 2026?
We spoke to about 1,300 IT leaders from various organisations to understand what they're evaluating. Most of it is the kind of thing you'd only hear from a peer you know well enough to ask, so we've put it in one place.
Read the report
SOC 2 Terms Your Customer's Security Team Will Use
You will hear eight terms in the first week. Learn them before the first call with the customer, so both sides mean the same thing.
What to Send the Customer While You Get to SOC 2 Type 2
Send the customer the evidence that matches your stage. Before any audit, send a security package and a completed questionnaire. After you sign an auditor, add the engagement letter and a dated plan. After fieldwork, send the Type 1. The Type 2 arrives only after the observation period closes and the auditor issues the report.
Stage 1: Readiness. You have no report yet. Send a one-page security overview, the policies you actually operate and a completed questionnaire in the customer's format, such as SIG, CAIQ or their own form. Add your subprocessor list with each vendor's own report. Questionnaires remain the default currency: 70% of the organizations in Secureframe's survey still rely heavily on questionnaires and RFPs.
Do not send your cloud provider's SOC 2 report as a stand-in. It covers the provider's controls. The customer asked about yours, and their security team will notice the swap.
Stage 2: Auditor signed. Send the engagement letter, or a short letter from the audit firm that confirms the audit dates. It proves the work is booked. It gives no assurance on your controls. Pair it with a contract clause that commits you to a Type 2 by a named date.
Stage 3: Type 1 issued. A Type 1 is a real CPA opinion on control design as of one date. Ask the customer early whether they accept it as an interim step.
Stage 4: Observation period. No new report exists during the window. Send short updates with three dates: window start, window end and expected report date.
Stage 5: Type 2 issued. This is the report the customer asked for. After it, management-signed bridge letters cover the months between report periods. A bridge letter does nothing for a first-time company, because there is no earlier report to bridge from.
Ask the Customer These Questions First
I make this call before I call any auditor. The answers set the scope, the report type and the date.
- Which report type do you need, and by which date?
- Which Trust Services Criteria matter to you: security alone, or availability and confidentiality too?
- Which of our services and systems must the report cover?
- Until the Type 2 exists, will you accept a Type 1, a completed questionnaire or a dated contract commitment?
- Who reviews the report on your side, and how do they want to receive it?
Write the answers into the deal record and confirm them by email. A verbal yes from a sales contact does not bind the customer's security team.
How Long Until You Can Hand Over a SOC 2 Report? Use the Deadline Planner
Count back from the customer's date. A first Type 2 needs three things in order: controls that already run, an observation window of at least three months in practice, and time for the auditor to issue the report. Add the window to the average issuance time, and the earliest first Type 2 lands a little over five months after the window opens.
The AICPA does not prescribe a minimum period for a SOC 2 report, as Barnes Dennig explains in its SOC FAQ. Cherry Bekaert reports that the shortest Type 2 testing period it sees in practice is three months. The CBIZ 2024 SOC Benchmark Study of 193 SOC 1 and SOC 2 reports found an average of 69.9 days from period end to issued report. 85% of those reports were issued within 100 days.
None of those numbers include readiness work. Readiness time depends on where you start, so the planner below does not guess it.
SOC 2 Type 1 vs Type 2: What Each Tells Your Customer
A Type 1 tells the customer that your controls were designed properly on one date. A Type 2 tells the customer that those controls operated across a period, and it shows the auditor's tests and any exceptions. Security teams that handle sensitive data usually prefer the Type 2, because only the Type 2 contains operating test results.
I treat a Type 1 as a bridge across the observation window. It gives the customer a CPA opinion early, while the Type 2 window runs. Plan the Type 2 in the same week you plan the Type 1, so the customer sees both dates together.
The length of the period also matters to the reader on the other side. A three-month Type 2 is a valid report. A security team that reviews many vendors will still see that the window is short, so tell them when the next, longer period starts. Schneider Downs notes that an auditor may agree to a shorter period for a first report.
Is SOC 2 a Certification?
No. SOC 2 is an attestation report. A licensed CPA firm examines your controls under AICPA attestation standards and issues an opinion. No certificate exists, and no public registry lists SOC 2 holders.
The word compliance never appears in a SOC 2 examination, as the Journal of Accountancy points out. Use SOC 2 report in contracts and sales material. It sets the right expectation with procurement from the first email.
Can You Skip Type 1 and Go Straight to Type 2?
Yes. No AICPA rule requires a Type 1 before a Type 2. Skip it when the customer accepts only a Type 2 and your controls already run with evidence. Keep it when the customer needs a CPA opinion before the Type 2 window can close.
Which SOC 2 Trust Services Criteria Do You Need?
Security is required in every SOC 2 report. Availability, processing integrity, confidentiality and privacy are optional. Add an optional category only when the customer asks for it or your contracts make a commitment in that area. Each category you add brings more controls, more evidence and more auditor testing.
The current criteria are the AICPA's 2017 Trust Services Criteria with points of focus revised in 2022. The 2022 revision changed the guidance. It left the criteria themselves unchanged. Security is also called the common criteria, numbered CC1 through CC9, because every SOC 2 report includes them.
A-LIGN, an audit firm that says it has completed more than 13,800 SOC 2 audits, reports that most technology companies on a first SOC 2 scope to security plus one or two other categories. That matches what I see in procurement. Availability and confidentiality come up most often, because they map to the uptime and data clauses already in your contracts.
My rule for a deadline audit: scope to the customer's written request, then stop. You can add a category at the next period. You cannot remove the testing burden from a category you added in a rush.
One trap catches teams often. Confidentiality and privacy sound alike, but they cover different data. Confidentiality protects business information that customers hand you. Privacy covers personal information about individuals and how you collect, use and dispose of it.
SOC 2 Readiness Assessment: How to Find Your Gaps Before the Auditor Does
A SOC 2 readiness assessment compares your current controls to the criteria you chose. It gives you a scope, a gap list and a fix plan with owners and dates. It gives no opinion. Your internal team, a consultant, a compliance platform's built-in assessment or an audit firm can run it, within the AICPA independence limits.
A good readiness assessment covers five things:
- System boundary. The services, infrastructure and data the report will describe.
- Policies. Which policies exist, who approved them and whether staff acknowledged them.
- Control mapping. Each criterion mapped to a control you actually run.
- Evidence check. For each control, the record an auditor will sample, and whether that record exists today.
- Gap list. Each gap with an owner, a fix and a date.
A SOC 2 self assessment works when someone on the team has been through an audit before. Without that experience, a self assessment tends to check that policies exist. Auditors check that records exist. That difference is where first audits slip.
Can Your SOC 2 Auditor Also Do the Readiness Work?
Yes, within strict limits. Under the AICPA Code of Professional Conduct, readiness work is a nonattest service. The audit firm can find gaps and recommend fixes. Your management must make every decision and own the result. If the firm designs, implements or operates the controls it later tests, it reviews its own work, and its independence is impaired.
The AICPA ethics committee also clarified how independence rules apply to attestation engagements such as SOC 2. The clarifications apply to engagements that start on or after June 15, 2026.
I keep the firm that helps build controls separate from the firm that signs the report. That choice removes the question before a customer's security team asks it.
Scoping: Systems, People and Vendors in the SOC 2 Audit
Scope decides how much evidence you collect for the rest of the year. Every system you add multiplies the samples the auditor pulls.
- Systems. Include the product and infrastructure the customer relies on. Leave out internal tools that never touch customer data or the service.
- People. Include everyone with access to in-scope systems, contractors too. Each person adds onboarding, offboarding and training records.
- Vendors. Your cloud host and other key providers are subservice organizations. The usual approach for cloud hosting is the carve-out method: your report refers to the vendor's own SOC report and excludes the vendor's controls from your testing. The inclusive method brings the vendor's controls into your report.
- Complementary user entity controls. These are the controls your customer must run, such as managing their own user accounts in your product. The report lists them, so the customer knows their side of the deal.
SOC 2 Compliance Checklist: What You Have to Fix Before the Audit
Auditors look for three things in each control area: a written policy, a control that your systems enforce, and records that prove people followed both. The SOC 2 compliance checklist below covers the 13 areas that carry most first-audit work. Each row lists the evidence auditors request and the gap I see most often.
The exception data points to the same few areas. The CBIZ 2024 benchmark found that 54.9% of the 193 SOC 1 and SOC 2 reports it reviewed had at least one control exception.
The most common causes were business approvals and reviews (16.5%), user access reviews (15.6%), terminations (12%) and change management (11.7%). Schneider Downs puts late removal of access for departed users at the top of its own list.
An exception does not end the audit. The auditor lists each exception in the report with your management's response. A pattern of exceptions in one area can lead to a qualified opinion, which tells the customer that your controls met the criteria except in that area. The customer's security team reads the exception list, so fix the pattern before the window opens.
The cheapest fix is a calendar. Put every periodic control on one schedule: access reviews, vendor reviews, restore tests and training. Give each one a named owner and a backup owner.
Compliance Platform, Auditor or Consultant: Who Does What in a SOC 2
A first SOC 2 involves three separate purchases. A compliance platform collects evidence and monitors controls. A licensed CPA firm examines the controls and signs the report. A readiness consultant or vCISO builds the program and closes the gaps. The firm that signs the report can never be the party that builds and runs your controls.
Do You Need Compliance Software to Pass SOC 2?
No standard requires it. A small, stable scope can run on a shared drive and a disciplined calendar. Software earns its cost when you have many systems and few people, because it pulls evidence automatically instead of by screenshot.
That describes many first-time teams. Secureframe's survey found that more than half of respondents work with one or fewer full-time security professionals, and nearly a third have none. A-LIGN's 2026 Compliance Benchmark Report found that 95% of respondents use technology in their audit and assessment work.
If you decide to buy, compare SOC 2 compliance platforms on integrations and evidence quality. If you need the wider view of risk and policy tooling, read what GRC software does.
How to Choose and Verify a SOC 2 Auditor
I pick the auditor before the platform. The auditor decides which evidence it accepts and how it samples. A platform that exports evidence your auditor will not use saves you nothing.
Auditor choice carries more weight in 2026 than it did two years ago. In February, the chair of the AICPA's SOC 2 Working Group told the Journal of Accountancy that fast and easy may come at the expense of quality and objectivity. The same article describes tool vendors that promise SOC 2 results in weeks or even hours.
The AICPA then acted on two fronts:
- Advertising. AICPA ethics staff listed examples of advertising that may be prohibited, including a guaranteed clean audit and calling a service auditor AICPA-approved.
- Peer review. The AICPA Peer Review Board told reviewers that SOC 2 engagements with identical reports, risk assessments, sample sizes and test procedures across clients are nonconforming.
In March 2026, TechCrunch reported allegations that compliance startup Delve produced fake evidence and templated auditor conclusions. Delve denied the allegations. Customers' security teams now read the auditor's name on every report they receive. A-LIGN's 2026 survey found that 83% of respondents saw clear quality differences between audit providers.
Use these steps before you sign an engagement letter:
- Get the legal name of the CPA firm that will sign the report.
- Check the firm's license and the lead CPA's license on NASBA's CPAverify or with the state board of accountancy.
- Look up the firm in the AICPA Peer Review Public File. Note the date of its most recent accepted review.
- Ask who performs the tests, who signs the opinion and how many SOC 2 audits the team has completed.
- Ask how the firm tailors its tests and sample sizes to your systems.
- Ask for the full timeline, from kickoff to the final report in your hands. A-LIGN's list of questions to ask a SOC 2 auditor warns that short headline timelines often cover evidence collection only.
- Treat a guaranteed clean opinion, or a report promised in weeks, as a reason to walk away.
What SOC 2 Costs and How Long It Takes
Budget for five cost lines: the auditor, a platform, outside help, gap-closing tools and internal time. No independent survey with a published method tracks SOC 2 audit fees. The fee ranges below come from a compliance platform vendor, so treat them as planning ranges and get written quotes on the same scope from at least three firms.
Drata's SOC 2 cost guide gives the fee and first-year ranges above. Drata sells a compliance platform, so I use its figures as a sanity check, not a budget. The real number comes from quotes on your written scope.
Time follows the same logic. Some phases have solid data. Others depend on you.
The observation period is the only phase that money cannot shorten. Three months of operating evidence takes three months of calendar time. Spend your effort on the phases before it, so the window opens as early as possible.
After the First SOC 2 Report: Bridge Letters, Renewals and the Next Customer
The first report starts a yearly cycle. SOC 2 reports carry no formal expiry date, but Schneider Downs notes that buyers generally expect a report no more than 12 months past the end of its period. Plan the next period to start the day after the current one ends, so no month goes uncovered.
- Bridge letters. Between reports, your management signs a bridge letter. It states that controls continued to operate with no material change since the period ended. The auditor does not sign it. Linford & Co. notes that most bridge letters cover no more than three months.
- Renewals. Keep the periodic controls on the calendar you built for the first audit. A missed access review in month eight shows up as an exception in the next report.
- The next customer. The report will not end questionnaires. Secureframe found that 70% of organizations still rely heavily on questionnaires and RFPs. Map your standard answers to sections of the report, and publish a trust page with your policies, subprocessors and a request path for the report under NDA.
Closing Thoughts on SOC 2 Readiness Under a Customer Deadline
A customer's SOC 2 request feels like a wall. It is a schedule. Call the customer first and agree on what they will accept and when. Then pick and verify the auditor, run the readiness assessment and close the gaps that auditors find most often.
Give the customer something new at each stage: a security package now, an engagement letter next, a Type 1 if they accept it, then the Type 2. The observation window cannot shrink, so every week you save before it opens is a week you give back to the deal.
Your auditor's opinion and your customer's contract decide what is acceptable. Nothing here is legal or audit advice.
Need a SOC 2 Report for a Customer?
Explore compliance platforms, auditors and readiness partners that fit your deadline and your starting point. It is private and free.
FAQ
What is the difference between SOC 2 Type 1 and Type 2?
A SOC 2 Type 1 report gives a CPA opinion on whether your controls were designed properly as of one date. A Type 2 report adds testing of whether those controls operated effectively across a period, and it lists each test and any exceptions. Customers that handle sensitive data usually prefer the Type 2, because only the Type 2 shows how the controls worked over time.
How long does it take to get a SOC 2 report?
It depends on your starting point. The AICPA sets no minimum observation period for a Type 2, but three months is the shortest period auditors see in practice. CBIZ's 2024 study of 193 SOC reports found an average of 69.9 days from period end to issued report. Readiness work comes before both, so a first Type 2 usually takes well over five months from a standing start.
Can we give a customer a Type 1 while we work on Type 2?
Yes, if the customer accepts it. A Type 1 is a real CPA opinion on control design as of one date, so it gives the customer independent evidence early. Ask the customer's security team before you commit, and pair the Type 1 with a dated commitment to a Type 2. No AICPA rule requires a Type 1 first, so you can also skip it.
What is a SOC 2 bridge letter?
A bridge letter, also called a gap letter, is a statement that your management signs. It says controls continued to operate with no material change since your last SOC 2 report's period ended. The auditor does not sign it, and most bridge letters cover no more than three months. A bridge letter only works after you have a report, so it does not help a first-time company.
Do we need compliance software to pass a SOC 2 audit?
No. No standard requires a compliance platform, and the auditor tests your controls whatever tool collects the evidence. Software saves time when you have many systems and a small team, because it collects evidence automatically and monitors controls between audits. Pick the auditor first, then confirm that the platform's evidence exports fit the auditor's test plan.
Which Trust Services Criteria do we need?
Security is required in every SOC 2 report. Availability, processing integrity, confidentiality and privacy are optional. Add an optional category only when the customer asks for it or your contracts commit to it, such as an uptime clause for availability. Each added category brings more controls, evidence and testing, so scope a deadline audit to the customer's written request.
Is SOC 2 a certification?
No. SOC 2 is an attestation report. A licensed CPA firm examines your controls under AICPA attestation standards and issues an opinion on them. No certificate exists, and no public registry lists SOC 2 holders. Use the term SOC 2 report in contracts and sales material, so procurement knows to request the report and read the auditor's opinion.
