On the AICPA's SOC page, three of the newest items are about speed. A February 2026 Journal of Accountancy piece is titled "Promises of 'fast and easy' threaten SOC credibility", an April 2026 piece covers "The risks of quick-turn SOC engagements", and a 14 May 2026 item says the AICPA is guiding peer reviewers to address SOC 2 risks. Buyers read those too. They are getting more careful about what vendors claim, so the way you word an answer matters as much as the control behind it.
This post covers the 20 questions that show up in almost every questionnaire, with a pattern for answering each one accurately.
What's affected
Every questionnaire format asks versions of the same questions: CAIQ, SIG Lite, HECVAT, and the custom spreadsheet from a customer's procurement team. The wording differs, the substance does not. If you answer these 20 once, in a shared document that an engineer has checked, you can reuse them across all formats.
The core rule for all of them: answer yes or no first, then state the scope, then name the evidence. "Yes, all production databases use AES-256 encryption at rest through our cloud provider's managed keys" beats "We take encryption very seriously."
The 20 questions and how to answer them
| # | Question | How to answer accurately |
|---|---|---|
| 1 | Is data encrypted in transit? | Name the minimum TLS version you accept and where. NIST SP 800-52 Rev. 2 treats TLS 1.2 as the minimum for federal systems and requires TLS 1.3 support by 1 January 2024, so "TLS 1.2 or higher" is a safe, checkable statement. |
| 2 | Is data encrypted at rest? | Say which stores: databases, object storage, backups, laptops. Do not write "all data" unless you checked each store. |
| 3 | Who manages the keys? | Cloud provider managed, customer managed, or your own KMS. State rotation if it is automatic. |
| 4 | Is MFA required for employees? | State which systems: identity provider, source control, cloud console, production access. Say how it is enforced, not just that it is "required". |
| 5 | Is MFA available to customers? | Yes or no. If SSO is supported, say which protocols. |
| 6 | How are passwords stored? | Salted and hashed with a modern password hashing scheme. NIST SP 800-63B-4 (July 2025) says passwords shall be salted and hashed with a suitable scheme. |
| 7 | Do you back up customer data? | State frequency, retention, location, and whether backups are encrypted. |
| 8 | Do you test restores? | Give the date and result of the last test. If you have never tested, say so and give a date for the first one. |
| 9 | Do you have a disaster recovery plan? | State the RTO and RPO you target, and whether the plan has been exercised. A written plan that was never tested is "documented, not yet tested". |
| 10 | Do you log access and admin actions? | Name what is logged, where it goes, who can edit it, and retention in months. |
| 11 | Do you monitor logs for incidents? | Say whether alerts exist and who receives them. Logging without review is a different answer from monitoring. |
| 12 | Have you had a penetration test? | Give the year, who performed it (internal or third party), the scope, and whether findings were retested. Offer a summary, not the full report. |
| 13 | Do you scan for vulnerabilities? | Name what is scanned (code dependencies, containers, hosts) and how often. |
| 14 | What are your patching timelines? | State your own targets by severity and say they are targets. |
| 15 | What is your SOC 2 status? | See the wording below. |
| 16 | Do you have an incident response plan? | Yes or no, last exercised date, and your customer notification window. |
| 17 | Do employees get security training? | Frequency, onboarding requirement, and how completion is tracked. |
| 18 | Do you run background checks? | Say for whom and where local law allows. |
| 19 | Do you use subprocessors? | Yes or no, and where the list lives. |
| 20 | What happens to our data when we leave? | Deletion window, method, and whether you provide an export first. |
SOC 2 status wording
SOC 2 is an attestation report issued by a CPA firm, not a certification. Never write "SOC 2 certified". Use one of these, whichever is true today:
- "We have a SOC 2 Type 2 report covering the Security criteria for a stated review period. Available under NDA."
- "We have a SOC 2 Type 1 report as of a stated date. A Type 2 observation period is in progress."
- "We do not have a SOC 2 report. Here are our policies, our latest pen test summary and our completed CAIQ."
Type 1 covers the design of controls at a point in time. Type 2 covers operating effectiveness over a period, commonly three to twelve months. Say which one you hold.
How to check if you're exposed
Before you send anything, read your last three answers to any of the 20 questions and test each claim.
# Is TLS 1.1 still accepted?
openssl s_client -connect app.example.com:443 -tls1_1 < /dev/null 2>&1 | grep -E "Protocol|alert"
# Which TLS versions does the endpoint actually serve?
nmap --script ssl-enum-ciphers -p 443 app.example.com
Ask your cloud console, not memory, whether each database and bucket has encryption on. Check that the "last restore test" date exists in a ticket.
What to do now
- Put the 20 answers in one document with an owner and a "last verified" date next to each.
- Have the engineer closest to each control confirm the answer in writing.
- Replace absolute words (all, always, never, fully) with scoped statements.
- Attach evidence you can share: a pen test summary, a policy page, a screenshot of an enforced setting.
- Re-verify the document every six months, and after any architecture change.
How to avoid this trap
The common trap is a confident answer written by a salesperson from an old document. Make the engineering owner sign off, keep the "last verified" date visible, and keep a short list of known gaps next to the answers. If a customer later finds a gap you did not disclose, the whole questionnaire loses credibility.
Why it matters
Questionnaire answers are often attached to the contract. A wrong "yes" is a misrepresentation you signed. A precise "partially, with this plan and date" costs a follow-up call at worst.
Accurate answers also get faster over time. Reviewers trust vendors whose answers match their evidence, and they ask fewer follow-ups.
Try it yourself
Take your last completed questionnaire and mark each answer green (evidence attached), yellow (true but unverified), or red (cannot prove). Fix the reds first.
Click through it at your own pace, or open it full screen.
Quick check
Can you write "SOC 2 certified" in an answer?
No. SOC 2 is an attestation report from a CPA firm. State the report type, the criteria covered and the period.
What is the right answer when you have never tested a restore?
Say that backups exist, that restores have not been tested yet, and give the date the first test is scheduled.
What should every answer start with?
Yes or no, followed by scope and evidence.
