Blog · SOC 2 and sales · Problem 5 of 93
A deal stalled on SOC 2. Keep it moving while you start the work.
· 3 min read · By Case Jones
You are the founder or CTO, and a buyer's security team just said they need a SOC 2 report. You do not have one, and the champion inside the company is asking you what to tell their boss.
What it costs to leave it
The deal sits in a queue while your champion loses momentum, and the next buyer will ask the same thing. Promising a report by a date you cannot control can damage the relationship more than the gap itself. Meanwhile, every week without written policies is a week your future audit cannot look back on.
What to do this week, and what to start this month
SOC 2 is a report from an independent CPA firm about your controls. It takes time, so the goal this week is to give the buyer enough to keep going.
- 1
Ask what would satisfy them for now
Ask the buyer's security contact directly what they would accept without a report. Many will take a completed questionnaire, your core policies, a call with your technical lead and a written plan. Some need the report before signing, and it is better to know that now.
- 2
Send something real within a few days
A clear, honest questionnaire and a short security overview show that you take this seriously. Describe how you handle access, encryption, backups, incidents and vendors in plain words. Name the cloud services you run on and what they cover for you.
- 3
Write the core policies first
Policies are the base of everything an auditor will test. Start with information security, access control, incident response, change management, vendor management and business continuity. Make them describe what you do today, then improve the practice where it falls short.
- 4
Decide on Type 1 or Type 2 with your auditor
A Type 1 report looks at your controls at one point in time. A Type 2 looks at whether they worked over a period, often several months. Talk to two or three audit firms about scope, price and timing before you commit to anything with the buyer.
- 5
Give the buyer a plan with honest dates
Share the steps and the dates you control, like when policies will be approved and when the audit firm is engaged. Avoid promising the report date itself, since that depends on the auditor and on what they find.
Or start with the policies today
93 Compliance was built by a former VP of Information Security who took doxy.me from zero to SOC 2 Type 2, through a SOC 2 Type 1 audit and two Type 2 audits. doxy.me is not affiliated with 93 Compliance and has not endorsed it.
The policy builder works out which SOC 2 documents you need, and an AI assistant writes them to match your company, with every edit as a tracked change for the owner to accept. The questionnaire check marks the buyer's questions green, yellow or red against those policies, so you can answer them this week.
It is free, and it does not certify you. A CPA firm does the audit. What you get is the groundwork the audit will look at, in place sooner.
- The SOC 2 documents you need, drafted
- The buyer's questionnaire checked against them
- Procedures that record evidence as work happens
- An audit package ready for your auditor later
Start with the policies
The policies, the questionnaire check, procedures and audits are free. Training records are $10 per employee per year.
Start freeWritten by Case Jones, who built 93 Compliance. Former VP of Information Security who took doxy.me from zero to SOC 2 Type 2, through a SOC 2 Type 1 audit, two Type 2 audits and a positive HIPAA assessment. doxy.me is not affiliated with 93 Compliance and has not endorsed it.
Questions
Can we say we are SOC 2 compliant before the audit?
No. Say you are preparing for a SOC 2 audit, and say which steps are done. Claiming compliance without a report misleads the buyer and can create legal trouble later.
Is SOC 2 a certification?
No. It is an attestation report written by a licensed CPA firm after it examines your controls. People often call it a certification, but there is no certificate, only the report.
Will buyers accept a SOC 2 Type 1?
Many will accept it as a first step, especially from a smaller vendor, and expect a Type 2 to follow. Ask the buyer before you plan around it.
What can we share instead of a SOC 2 report?
A completed questionnaire, your core policies, a security overview and a plan with dates are the usual set. Some buyers also want to see your cloud provider's reports, which the provider makes available to its customers.