Describe SOC 2 status in one of three honest ways: report issued with its date and scope, audit in progress with the expected period, or not started with a plan. SOC 2 is an attestation by an independent CPA, not a certification, so avoid the word certified.
What SOC 2 is
The AICPA describes SOC as a suite of services in which CPAs report on controls at a service organization. SOC 2 reports address criteria such as security, availability, processing integrity, confidentiality and privacy. The report states which criteria are in scope.
Three status statements
Issued. "We hold a SOC 2 report covering the Security criteria for the period X to Y, issued by an independent auditor." Share the report under NDA and name the scope.
In progress. "Our audit is underway with an expected report date of Z." Offer the control list and the evidence you already collect.
Not started. "We have not begun an audit. We operate these controls today and plan an audit by Z." Honest and often acceptable at early stage.
Words to avoid
- "SOC 2 certified" or "compliant" without qualification.
- Implying a report is final when fieldwork is open.
- Stating the scope as company wide when it covers one product.
- Quoting controls you do not operate.
Evidence helps more than the badge
Buyers want to know controls work. Access review exports, change approvals, vulnerability remediation records and incident exercises demonstrate that. Automating evidence collection keeps the story consistent over time.
Type 1 versus Type 2
A Type 1 report covers control design at a point in time. A Type 2 report covers operation over a period. Say which you mean, and do not describe either as the other.
Safeguard offers compliance and evidence automation to help collect this material.
Keeping answers consistent across documents
Status statements appear in many places: the data room index, questionnaires, the website trust page, sales decks and investor updates. They drift apart over time.
Keep one approved sentence for each status and reuse it. When status changes, update every place on the same day and log the change. If the website says one thing and a questionnaire says another, buyers notice.
Also keep a list of the exact scope: which systems, which criteria and which period. When someone asks whether a new product is covered, you can answer from the list rather than guess.
Finally, brief the sales team. Most overclaims are not written by compliance staff. They happen in conversation, so give salespeople the approved wording and a clear rule to defer to it.
Quick check
Can we say we are SOC 2 compliant while the audit is open?
It is safer to say the audit is in progress and describe controls you operate today.
Sources
Last reviewed: 19 October 2026.
