The short answer: be specific and show evidence
When your SOC 2 is underway but not yet complete, tell customers exactly where you are. Name the report type you are going for. Name the audit firm, if they agree to be named. Say when the observation period started and when you expect the report. The observation period is the stretch of time the auditor reviews. Then back it up with evidence you can share today. That could be a readiness letter, your security policies and a recent penetration test summary. A penetration test is a hired, legal attempt to break into your systems.
Most security reviewers are used to vendors in this position. What worries them is vagueness or overclaiming, not the fact that the report is still in progress.
What you must not claim
Overclaiming is the fastest way to lose a security reviewer's trust. It can also create contract and legal risk. Use the table below as a house style for sales and marketing.
| Do not say | Say instead |
|---|---|
| "We are SOC 2 compliant." | "We are in our SOC 2 Type II observation period, with the report expected in [month]." |
| "We are SOC 2 certified." | Nothing like this, ever. SOC 2 is an attestation report, not a certification. |
| "We passed our SOC 2." | "We have completed our readiness assessment and remediation." |
| "Our auditor has approved our controls." | "Our audit firm is engaged and fieldwork is scheduled for [month]." |
| "Report available next month" (when it is not) | A date with a buffer you are confident you can meet. |
Also avoid showing AICPA SOC logos or "SOC 2" badges on your website before you have a report. Check with your auditor about any use afterward. The AICPA is the US accounting body that sets SOC standards. Make sure sales, marketing and customer success all use the same approved wording.
Sample email to a prospect
Adapt this to your situation. Keep it short, factual and dated.
Hi [Name],
Thanks for sending over your security review. Here is where we are on SOC 2:
We are pursuing a SOC 2 Type II report covering the Security and Availability criteria. Our audit firm, [Firm], is engaged. Our observation period started on [date]. We expect to receive the report in [month and year]. We will send it to you under NDA as soon as it is issued.
In the meantime, we have attached three documents under our mutual NDA. They are a readiness letter from our security consultant, our information security policy and the executive summary of our most recent penetration test. We have also completed your questionnaire.
Happy to set up a call with our security lead to walk through anything in more detail.
[Signature]
Some prospects need a firm commitment in the contract. Many vendors agree to a clause that promises the SOC 2 report by a stated date. It often gives the customer a right to terminate if the report is not delivered. Agree to this only with a date you are confident of, and involve legal.
Bridge letters and what changes after your first report
Once you have a report, the problem changes. A SOC 2 Type II covers a fixed period that ends before the report is issued. So there is always a gap between the end of the period and today. A bridge letter (also called a gap letter) covers that gap. Your management writes and signs it, not your auditor. It states that there have been no material changes to your controls since the period ended, or describes any that occurred.
Bridge letters do not apply to a first-time audit, because there is no prior report to bridge from. For your first SOC 2, the readiness letter, engagement confirmation and supporting documents above do that job. From the second year on, a bridge letter plus the latest report is the standard package.
Build a security page or trust center
A public security page answers common questions before they turn into a questionnaire. Keep it accurate and update it when your status changes. Include:
- Your SOC 2 status in the approved wording, with an expected date
- An overview of key controls: encryption, access control and MFA (a second login step), logging and monitoring, backups, incident response, vendor management
- How often you run penetration tests
- A list of subprocessors and where data is hosted
- A request form for documents available under NDA
- A contact for security questions and vulnerability reports
How to use the SOC 2 journey for sales traction
A SOC 2 in progress can help win deals rather than delay them, if you treat it as a sales asset:
- Tell your pipeline early. Prospects who stalled on security may come back once they hear a report is coming, with a date.
- Give sales a short status note and a one-page security overview. Then they can stop forwarding every question to engineering.
- Get the security team on calls with large prospects. A capable, honest security lead builds more trust than a badge.
- Answer questionnaires using the controls you built for SOC 2. The work maps directly onto common questionnaire sections.
- Track deals blocked by security review, and follow up the day the report arrives.
- Announce the report when it is issued and update your trust center the same day.
For a refresher on what the report itself contains, see what is SOC 2 compliance. If your customers are unsure which SOC report they need, point them to SOC 1 vs SOC 2.
How NextGarrison helps
NextGarrison is not a CPA firm and does not issue SOC 2 reports. A CPA firm is a licensed accounting firm, the only kind that can issue one. Through our SOC 2 Readiness Program, we run your gap assessment and help you fix the gaps. We document the readiness work, so you can share progress with customers. We perform the penetration test most auditors and customers expect. We also help you prepare security documents and questionnaire answers. Your sales team then has something honest and useful to share while your audit firm completes the report.
Need a hand with this?
Talk to a senior consultant. We reply within one business day with clear next steps and a scoped quote.
Written by
NextGarrison Security TeamPenetration testers, SOC analysts and compliance consultants
Our consultants test applications and networks, run 24/7 security monitoring and prepare companies for SOC 2, ISO 27001 and PCI DSS assessments. We write about what we see in real engagements, in plain English.