Your customer asks for SOC 2, and you do not have it
SOC 2 is a US audit report on your security controls, prepared by an external auditor. Not having one does not automatically end the deal. Ask what the customer really needs, show what you have arranged with a well-evidenced questionnaire, policies and test results, and give an honest plan if SOC 2 or ISO 27001 is needed later.
Customers with a US parent or US procurement processes in particular ask for a SOC 2 report. For a Dutch or Belgian SaaS provider it is often not a standard. What can you do if you do not have one?
What SOC 2 is
SOC 2 is a report under the rules of the US professional body of accountants, the AICPA. An external auditor assesses your controls against the Trust Services Criteria: security, and optionally availability, processing integrity, confidentiality and privacy. It is not a certificate, but a report you share with customers under conditions.
Type I and Type II
| Type I | Type II | |
|---|---|---|
| What it says | The controls are well designed, at one point in time | The controls actually operated, over a period |
| Period | One date | An observation period, often 3 to 12 months |
| What customers usually want | A start | The report most buyers ask for |
Why your customer asks for it
SOC 2 is often a standard line in the procurement checklist, sometimes with “or equivalent”. What the customer really wants to know is whether an independent party has looked at your controls. That is the question behind the question.
What you can do
- Ask what counts as equivalent. Does the customer accept ISO 27001, an ISAE 3000 or ISAE 3402 report, or a completed standard list such as the SIG or CAIQ? In Europe, ISO 27001 is often more common.
- Show what you have. Policies, procedures, a recent penetration test, logging, backups and incident handling. With evidence, not just words.
- Use your cloud provider's reports, but honestly. Large cloud providers often have their own SOC 2 report. It covers their part, not your application, your access management or your development process.
- Make your security answers extra strong. A questionnaire with a source for every answer comes closest to what an auditor would do.
- Give a plan if it is really needed. If SOC 2 or ISO 27001 has to come, name a realistic timeline instead of a promise.
What you had better not write
- “We are SOC 2 compliant” without a report. That suggests an audit that does not exist.
- “Our hosting is SOC 2 certified, so we are too.” Responsibility for your own part stays with you.
- A date for a SOC 2 report you cannot meet.
How Holdvero helps
Holdvero does not provide SOC 2 audits or certification. We do complete your customer's security questionnaire based on your own documentation, with a source for every answer and honest open items. That way you show what you have arranged. Up to 150 questions: Questionnaire Rescue, €695. See also security questionnaire without ISO 27001.
Frequently asked questions
Is SOC 2 a certificate?
No. It is a report by an external auditor. You can share it with customers under conditions, often under an NDA.
Is ISO 27001 the same as SOC 2?
No. ISO 27001 is an international standard with a certificate for your management system. SOC 2 is a US report on your controls. Many customers accept one as an alternative to the other, but always ask.
How long does a SOC 2 Type II take?
It includes an observation period, often 3 to 12 months, plus preparation beforehand. So it is not a solution for a deal that has to close this month.
Can I still win the deal without SOC 2?
Sometimes, if the customer accepts an equivalent alternative and your answers are well evidenced. Ask early, before you put a lot of time into the rest of the questionnaire.
Need help with the security questionnaire without SOC 2?
Within 1 working day you'll hear the price and when you get it back. You only pay after agreeing the price.
Get a fixed price