Use a SOC 2 report to answer questionnaire rows about controls it tests, by pointing to the report and the exact control, period and category. Do not use it for rows it does not cover, such as product features or legal terms. Quote status precisely: Type, period and scope.
What does a SOC 2 report cover?
A SOC 2 report is an attestation by an independent CPA firm on controls at a service organization, measured against the AICPA's trust services criteria in security, availability, processing integrity, confidentiality and privacy (AICPA). It includes a system description, management's assertion, the auditor's opinion and test results.
So it is strong evidence for control questions and silent on much else.
Which rows can it answer?
Typical questionnaire topics that a report may support, if the controls are in scope:
- Access control and offboarding.
- Change management and code review.
- Vulnerability management and patching cadence.
- Logging and monitoring.
- Incident response.
- Backup and recovery, if availability is in scope.
- Vendor management.
- Encryption, as described in the system description.
For each, find the control in the report and cite it. "See SOC 2 report, security category, control reference, period ending on a stated date" beats "yes, we are SOC 2 compliant."
Which rows can it not answer?
Product specific questions: data residency options, single sign-on support, API rate limits. Contractual terms: liability, indemnity, breach notification windows. Anything outside the system boundary, or carved out to a subservice organization. And privacy questions if the privacy category was not examined.
For those, write a direct answer and link your own documentation.
How should you describe your status?
Precision matters, because an overclaim in a questionnaire can become a contract problem. State the report type, the period covered, the categories examined and the auditor's opinion type. If you hold a Type I only, say Type I. If a Type II is in progress, say it is in progress and give no date you cannot keep. If you have no report, say what you do have, such as written policies and evidence, and do not borrow the label.
Also note the report date. A report whose period ended eighteen months ago will draw questions, and a bridge letter covers only the gap since, as a management statement.
What about NDAs and sharing?
SOC 2 reports are usually shared under NDA. Set a standard process: a request form, a sharing link with expiry and a log of who received it. This saves your security team from emailing PDFs.
How do you avoid answer drift?
Build an answer bank: one approved answer per common question, linked to evidence, with an owner and a review date. Sales then reuses it rather than improvising. Review quarterly, and after any material change to your system.
What to do
- Read your own report and list which questionnaire topics each control supports.
- Build an answer bank with a citation to the report for each supported row.
- Mark rows outside scope and write plain answers for them.
- Write a one line status statement: type, period, categories.
- Set up NDA based report sharing with expiry.
- Review the bank every quarter.
- Have security approve any answer that sales edits.
Quick check
Can we say we are SOC 2 compliant?
SOC 2 is an attestation, not a pass or fail certification. State what you hold: the report type, period and categories.
What if the questionnaire asks about something outside the report?
Answer directly with your own evidence and say it is not covered by the report. Do not stretch the report to fit.
Sources
Last reviewed: 18 October 2026.
