Before the report
“SOC 2 in progress”: what you can honestly say.
Deals don't wait for reports. Prospects ask about SOC 2 long before the CPA firm signs anything, and the temptation is to round up. The safe approach is simple: say exactly which stage you are in, what is already true, and what isn't yet. Buyers respect precision far more than optimism.
Back to SOC 2 services01 · Why it matters
Why the exact words matter
A sales sentence can end up in a contract or a questionnaire.
Whatever you write in a questionnaire, a proposal or an email can be relied on later. If a security answer says you are compliant and the report later shows exceptions, or arrives months after the date you named, you have a credibility problem with exactly the customer you were trying to win.
A SOC 2 is an attestation: a CPA firm's opinion on your controls. Until that opinion exists, nobody has attested anything. Your wording should never suggest otherwise.
02 · Stage by stage
What is true at each stage, and how to say it
Six stages, one honest sentence each.
| Stage | What is true | Safe sentence | Unsafe sentence |
|---|---|---|---|
| Scoping | You've decided to pursue SOC 2 and are defining the system. | “We are scoping a SOC 2 examination for [product].” | “We're going through SOC 2.” |
| Readiness work | Gaps are being closed; no CPA firm testing has begun. | “We are preparing for a SOC 2 examination and closing gaps from a readiness assessment.” | “We meet SOC 2 requirements.” |
| Type 1 underway | A CPA firm is engaged to examine design as of a date. | “A CPA firm is performing a SOC 2 Type 1 examination as of [date].” | “We have SOC 2 Type 1.” |
| Observation period underway | Controls are operating and being evidenced; the window hasn't closed. | “Our SOC 2 Type 2 observation period began on [date].” | “We're SOC 2 Type 2 compliant.” |
| Fieldwork | The period has closed; the CPA firm is testing. | “The observation period ended on [date]; the examination is in fieldwork.” | “Our report is basically done.” |
| Report issued | A signed report exists. | “We have a SOC 2 Type 2 report for [period], available under NDA.” | “We are SOC 2 certified.” |
03 · Words to avoid
Words and promises to drop
Each one claims something you can't support yet, or ever.
- “SOC 2 certified”. There is no SOC 2 certificate, at any stage. It signals unfamiliarity to an informed buyer.
- “SOC 2 compliant”. Implies a conclusion only the CPA firm's opinion can give, and the opinion may contain exceptions.
- “Our report will be ready by [date]”. Issue dates depend on the CPA firm's testing and review. Name the period dates you control instead.
- “We passed the audit”. A SOC 2 opinion isn't pass or fail. Describe the report type and period.
- Badges and logos. A SOC 2 badge on a site before a report exists is a public claim, not a sales nuance.
About the AICPA SOC logo
The AICPA controls who may display its SOC logo, and those terms tie it to an issued report. Don't use it, or anything that looks like it, while you are in progress.
04 · Calls & questionnaires
Answering questionnaires and sales calls while in progress
Answer the control question, not the certification question.
- Answer each control question on its own facts. “Do you enforce MFA?” has a yes or no answer today, report or not.
- Separate status from controls. Put your SOC 2 stage in one standard sentence and reuse it everywhere.
- Name dates you control: the observation period start and end. Not the report issue date.
- Offer an alternative now: a call with your security lead, a readiness summary, or the policies a question refers to.
- Write down what you said. Store the answer in your answer library so the next rep says the same thing.
Illustrative: a prospect's questionnaire asks “Do you have a current SOC 2 Type 2 report?” A truthful answer reads: “Not yet. Our Type 2 observation period began on 1 May and ends on 31 October. A readiness summary and our security policies are available under NDA now.”
Questions about “in progress”
Can we say “SOC 2 ready” after a readiness assessment?
Only with context, and it's easily misread.
A readiness assessment is advice, not an examination. If you use the phrase, say who assessed you and that no CPA firm opinion exists yet. Plainer is safer: “preparing for a SOC 2 examination”.
A prospect wants a date in the contract for our report. What do we do?
Commit to what you control.
Commit to starting and maintaining the observation period, and to providing the report once issued. Avoid a hard issue date; it depends on the CPA firm's work.
Can we list SOC 2 on our website while in progress?
As a status line, yes. As a badge, no.
A dated status line (“SOC 2 Type 2 observation period under way since [date]”) is honest. A logo or badge reads as an issued report.
What if a Type 2 is in progress but our Type 1 is already issued?
Say both, precisely.
“We have a SOC 2 Type 1 report as of [date]; our Type 2 observation period began on [date].” Share the Type 1 under NDA.
Say it accurately, close the deal anyway.
We help you prepare a readiness summary and a standard status sentence your whole team can use while the SOC 2 runs.