Questionnaires
SOC 2 and security questionnaires: answer once, point often.
A SOC 2 report won't make questionnaires disappear, but it changes what they are for. The report settles questions about whether your controls exist and operate. A questionnaire still asks things no report can: about the buyer's own data, contract and risk appetite. Treat the report as the reference and the questionnaire as the index.
Back to SOC 2 services01 · What it settles
What a SOC 2 report settles, and what it doesn't
Independent evidence on your controls. Silence on everything else.
The report settles
- Whether the controls in the description were well designed and, if it is a Type 2, whether they worked in practice across the period
- Which criteria were in scope and how the controls map to them
- Exceptions the CPA firm found, and management's response
- Which vendors are carved out, and what customers are expected to do (CUECs)
It doesn't settle
- Anything outside the system boundary
- Where this buyer's data will be stored or which region
- Contract terms: notification windows, liability, audit rights
- Regulatory questions specific to the buyer's sector
- Anything that happened after the period end
02 · Mapping sections
How the report maps onto common questionnaire sections
Most sections have a home in the report; a few never will.
Standardized questionnaires such as the Cloud Security Alliance's Consensus Assessments Initiative Questionnaire (CAIQ) and Shared Assessments' Standardized Information Gathering (SIG) questionnaire group questions into control domains. The domain names differ between formats and versions, but the same broad areas recur, and most of them correspond to the common criteria.
| Questionnaire area | Where the report speaks to it | What usually still needs a direct answer |
|---|---|---|
| Governance and policy | CC1, CC2, CC5 controls; the system description | Named owners, policy review dates |
| Risk management | CC3 and CC9 controls | How this buyer's data is risk-rated |
| Access control and identity | CC6 controls and test results | Specific technologies, if asked |
| Operations, logging and monitoring | CC7 controls | Retention periods, alert routing |
| Change management and secure development | CC8 controls | Release cadence, specific tooling |
| Incident response | CC7 controls; incidents disclosed in the description | Notification commitments to this buyer |
| Third parties | Subservice organizations, CSOCs, vendor controls | A current subprocessor list |
| Business continuity | Availability criteria, if in scope | Recovery targets, if not in the report |
| Privacy and data location | Privacy or Confidentiality criteria, if in scope | Data residency, transfers, legal basis |
We describe these formats only in general terms. Check the version the buyer sent; domain names and question counts change between releases.
03 · Answer library
Build an answer library that points to the report
One maintained answer per question, with a pointer, not a paraphrase.
- The question
- Normalized wording, with the variants buyers use.
- The short answer
- Yes, no or partial, in one sentence that stays true.
- The pointer
- The control ID and section of the SOC 2 report that covers it, for example “see control CC6.1-03, Section 4”.
- The owner
- Who keeps this answer accurate.
- Last checked
- The date it was confirmed, and the report period it points to.
Pointing beats repeating. A paraphrase of the report drifts from it over time and becomes a second, unaudited version of your controls. A pointer stays accurate as long as the report does, and tells a reviewer exactly where the independent evidence sits.
04 · Attach or answer
When to attach the report and when to answer directly
Attach for assurance; answer for specifics.
- The buyer accepts a report in lieuMany vendor-risk teams let a current SOC 2 replace large parts of their questionnaire. Ask before filling in every row.
- The question is about a controlGive a short answer and a pointer; offer the report under NDA.
- The question is about this customerAnswer directly. The report can't speak to their data, region or contract.
- The report is ageingAttach it with a bridge letter, and answer anything that changed since the period end.
- The report has an exception on the topicAnswer directly and mention the exception and the fix. Don't let the buyer find it on their own.
05 · Question types
Question type, coverage and response
A quick sort for any questionnaire that lands.
| Question type | Does the report answer it? | How to respond |
|---|---|---|
| “Do you have a current SOC 2 Type 2?” | Yes, by existing | State type, period and categories; share under NDA. |
| “Do you enforce MFA for administrative access?” | Usually, if the control is described | Yes, with a pointer to the control. |
| “Were there any exceptions?” | Yes, Section 4 | Summarize honestly; point to management's response. |
| “Where will our data be stored?” | Rarely at the level the buyer wants | Answer directly for this customer. |
| “Will you notify us of a breach within N hours?” | No; that's a contract term | Answer from your contract or DPA. |
| “Which subprocessors will touch our data?” | Partly, via subservice organizations | Provide your current subprocessor list. |
| “Is your product compliant with our sector regulation?” | No | Answer from your own legal and compliance position. |
| “What changed since your last report?” | No | A bridge letter, or a direct answer. |
06 · Never answered
Questions a SOC 2 report can never answer
Keep these answers ready, because no report will carry them.
- How this customer's data will be segregated, stored and deleted.
- Contractual commitments: notice periods, audit rights, liability, insurance.
- Your posture on a specific threat or vulnerability in the news this week.
- Roadmap promises: features, certifications or regions you plan to add.
- Anything about systems you deliberately kept outside the boundary.
Sources: AICPA SOC 2 guide; AICPA TSP section 100 (2017 Trust Services Criteria with revised points of focus); AICPA DC 200 description criteria. CAIQ (Cloud Security Alliance) and SIG (Shared Assessments) are named as public formats only.
Questionnaire questions
Can we just reply “see our SOC 2” to every question?
No; it pushes the work onto the buyer.
Give a short answer and a precise pointer. A blanket reference makes the reviewer hunt, and some questions aren't covered by the report at all.
Should the answer library quote the report word for word?
Point to it; don't copy it.
Copied passages go stale when the next report changes wording, and the report is usually shared under restrictions. Keep a control ID and section reference instead.
A buyer won't sign an NDA but wants the report. What now?
Answer the questions directly, or consider a SOC 3.
A SOC 2 report is normally restricted to informed readers. A SOC 3 is a general-use summary you can share more widely, but it carries far less detail.
Our answers and our report disagree. Which wins?
Fix the answer.
The report is what an independent firm tested. If your library says otherwise, either the answer is wrong or the system changed, and the change belongs in a bridge letter.
Turn your report into fewer questionnaire hours.
We build an answer library mapped to your SOC 2 controls, so each answer points to evidence instead of repeating it.