While your SOC 2 Type 1 is in progress, answer security questionnaires with specific, true statements about controls you operate today, say plainly that an audit is underway, and offer evidence. Do not describe the report as complete, and do not imply a certification, because SOC 2 is an attestation issued by an independent auditor.
What buyers are really asking
A questionnaire is a proxy for one question: can we trust you with our data? Many buyers ask for a SOC 2 report because it is a recognised shorthand. If you do not have one yet, a clear control by control answer plus a dated plan often keeps the deal moving. The AICPA text is explicit that a Type 1 report covers control design at a point in time, with no opinion on operating effectiveness, so be careful not to claim more than the report will say, even after it arrives.
Words to use and words to avoid
Use: "We are undergoing a SOC 2 Type 1 examination with an independent auditor, expected to conclude later this year." If you name a date, make sure you control it, and update it if it moves.
Use: "We enforce MFA for all staff on our identity provider and require pull request review before production changes."
Avoid: "SOC 2 compliant", "SOC 2 certified" or "SOC 2 ready" without qualification. SOC 2 has reports, not certificates, and an in-progress audit is not a result.
Avoid: absolute words such as "all", "never", "always" unless you can prove them.
How to answer common sections
Access control (CC6). State how access is granted and removed, whether MFA is enforced, and how often access is reviewed. Attach a redacted review record if you have one.
Change management (CC8.1). Say how changes are reviewed and approved and how production access is limited.
Vulnerability management (CC7.1). Give scan cadence and your remediation targets, and be ready to show the last scan and closure tickets.
Incident response (CC7.3 to CC7.5). Describe severity levels, roles and notification practice. Mention tabletop exercises only if you have run one.
Vendors (CC9.2). Say how you assess vendors and who owns the relationship.
Encryption and data handling (CC6.7, C1.1). State what is encrypted in transit and at rest, and where data lives.
Continuity (A1.2, A1.3). Describe backups and how you test restores, if you do.
Build a reusable answer bank
Write each answer once, have the control owner approve it, and store it with an evidence link and a last verified date. Tag answers by topic. When someone changes a control, update the answer. An answer bank cuts response time and prevents two reps giving different answers to the same question.
Offering evidence safely
Offer a trust page or a summary document, then share detailed material under NDA. Redact customer names and internal hostnames. If a buyer asks for penetration test results, share a summary rather than raw findings.
When a buyer insists on the report
Some procurement teams will not move without the report. Offer a call with your security lead, a summary of controls mapped to the criteria categories, and a written commitment to share the report when issued. Ask whether they will accept a bridge letter from you later, but do not draft anything that reads like an auditor's opinion. If the deal depends on a report you do not have, say so plainly and let them decide.
What to do
- Write a standard status statement about the audit, approved by management.
- Collect your 30 most common questions and answer them from real settings.
- Assign an owner and verification date to each answer.
- Attach or link evidence for each answer where possible.
- Review all answers when your Type 1 report is issued, and again when scope changes.
- Route unusual questions to the compliance lead rather than answering ad hoc.
- Track questionnaires and deal outcomes so you can see which gaps cost you.
Quick check
Can I say we are SOC 2 compliant before the report?
No. Say that an examination is underway with an independent auditor. Compliance is assessed by the auditor, not self-declared.
Should I share my draft policies?
Share approved, current policies under NDA if asked. Do not share drafts or documents that describe controls you have not implemented.
How Safeguard helps automate this
Answering the same questions repeatedly is time you could spend elsewhere. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so answers are grounded in evidence collected from connected systems and code instead of screenshots, and monitoring runs continuously so answers stay current. Technical evidence for vulnerability and dependency questions comes from your real code and dependencies: scans, SBOMs and reachability. Autonomous remediation can open tested fix pull requests for vulnerable dependencies; it is off by default, every category starts on Manual, and you choose which categories run automatically and at what approval level. Safeguard helps you prepare and keep evidence ready; it does not certify you or replace your auditor. Book a call.
Sources
- AICPA, Trust Services Criteria (2017, with 2022 points of focus): Type 1 definition and criteria IDs cited. Paraphrased.
Last reviewed: 18 October 2026.
