SOC 2 and the deal
What the buyer's security team does with your SOC 2 report.
Somewhere in every enterprise deal, one person on the buyer's side opens your report and decides whether the risk is acceptable. Knowing what that security reviewer reads, and in what order, tells you how to prepare three things: the report itself, the questionnaire answers around it, and the message you give while the audit is still running.
Back to SOC 2 services01 · What they read
The reviewer's reading order
Most reviewers check six things before they look at a single control.
- The opinion: unmodified, or modified, and if so on which criteria.
- Type and period: months of tested operation weigh more than a single date, and an old period end raises the question of what has happened since.
- The boundary in the system description: is the product being bought inside it?
- Carved-out providers: which hosting or processing suppliers are excluded from testing, and whether their own reports exist.
- Exceptions in the test results, read next to management's response.
- Complementary user entity controls (CUECs): the duties the report hands back to the buyer.
Any one of these can stall a deal. A report whose boundary leaves out the module the buyer wants, or whose period closed long ago, invites a long follow-up list however clean the opinion is. Run your own report through this order before a prospect does.
A Type 1 while the Type 2 runs
A Type 1 report covers control design at one date. A licensed CPA firm signs it, so a reviewer can read it as a real milestone while your first observation period is still open.
02 · Questionnaires
Sorting a questionnaire into three piles
Each question is answered by the report, by a current fact, or by the contract.
| Kind of question | Where the answer comes from | Usual owner |
|---|---|---|
| Is access to production reviewed? | The matching control and its test result in the report | Security lead |
| Which regions host our data today? | A current statement, because the report describes a past period | Engineering |
| Do you support single sign-on with our identity provider? | Product documentation; features normally sit outside the tested controls | Product |
| How fast will you tell us about a breach? | The contract or data processing agreement | Legal |
| Which subprocessors handle our records? | A maintained subprocessor register | Privacy or legal |
Sorted this way, a two-hundred-line spreadsheet shrinks to a short list of questions that are genuinely new. Store the sorted answers in one shared place, give each an owner and a review date, and cite report items by the numbering used in your report rather than by criterion.
Some questions belong to the buyer. Where a control depends on them, such as managing their own users inside your product, name the relevant CUEC and say so plainly.
03 · Gaps
Questions a clean report will not settle
Expect follow-ups on these whatever the opinion says.
- Where data is stored, and whether it can stay in one country.
- How long customer records are kept after the contract ends, and how deletion is confirmed.
- Whether customer content trains any machine-learning model.
- Limits on cyber insurance cover.
- Clauses a regulator imposes on the buyer, such as audit access for a bank's supervisor.
- Anything that changed after the period closed: a new region, an acquisition, a new product line.
- Sending the report before an NDA. A SOC 2 is a restricted-use report, meant for readers who understand the system. Share it under a nondisclosure agreement, as its own use paragraph expects.
- Staying quiet about exceptions. The reviewer will find them in the test results. A short note on cause and fix, sent with the report, closes the topic sooner.
- Offering a report on another product. If the deal covers a product outside the boundary, say so up front and offer other evidence.
04 · Mid-audit
Describing an audit that has not finished
Precise claims survive a reviewer's check; vague ones collapse.
Accurate
Statements you can defend
- “Our first Type 2 observation period ends on [date], and a licensed CPA firm is engaged.”
- “The controls are operating; we can walk you through the evidence under NDA.”
- “We will send the report as soon as the firm issues it.”
Overreach
Statements that backfire
- “We are SOC 2 certified.” There is no SOC 2 certificate.
- “We are SOC 2 compliant,” with no report yet issued.
- A badge or logo on the website before any report exists.
- A fixed report date the CPA firm has not committed to.
Supporting material reviewers often take in the meantime: your policy set, a summary of an independent penetration test, the signed engagement letter with the audit firm, a readiness review summary, and answers to a standard questionnaire.
Sources: AICPA, SOC 2 guide (Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy); AICPA TSP section 100, 2017 Trust Services Criteria with revised points of focus (2022); AICPA attestation standards AT-C 105 and AT-C 205.
05 · Go deeper
Go deeper
Dedicated pages on topics this guide only touches.
Buyers, reviewers and your report
Should the report sit on our public website?
No. Publish a summary, or a SOC 3, instead.
A SOC 2 is written for customers and their auditors, so it goes out on request under an NDA. If you want a document anyone can download, a SOC 3 is the general-use report made for that. The AICPA controls use of its SOC logos, so read its current terms before placing one on the site.
A reviewer flagged an exception. What do they want from us?
The cause, the impact and the fix.
Explain what failed, whether any customer data was affected, and what changed afterwards. Proof of the fix, such as later samples that passed, carries more weight than a promise.
Can a qualified opinion lose a deal?
Sometimes, when it touches what the buyer cares about.
A qualified opinion means the CPA firm found a problem serious enough to name in the opinion itself. Buyers look at which criteria it affects. A qualification on physical security at a data centre may barely register; one on access control needs a clear remediation story and, often, the next period's report.
How recent does the period need to be?
No standard sets an age limit; buyers set their own.
The AICPA standards say nothing about how old a report may be. Procurement teams commonly look for a period that ended within about the last year, plus a bridge letter from you covering the months since.
Turn security reviews into a fast yes.
A SOC 2 readiness assessment sets your scope around the deals you're trying to close.