Customer asking for SOC 2 report? Read the ask first

It shows up as one line in a long email. Legal is done, the order form is sitting in somebody’s inbox, and the security review needs your SOC 2 before anything moves. Nobody at your company has seen a SOC 2 report. The customer’s date does not move.

Two questions matter now, in this order. What will physically exist on the deadline, and will this particular buyer accept it? Every timeline article answers a third question instead, the one about average phase durations, which is no use to you at all while a contract sits unsigned.

Read the ask before you buy anything

Procurement teams write “SOC 2” without saying which one. The wording tells you which product you actually need, and the gap between the two is months of calendar time. Three phrasings cover most asks.

• “Send us your SOC 2.” No further detail, no version named. A Type 1 clears this. The reviewer is closing a checklist item and wants to see a signed opinion from a licensed CPA firm with your company name on it.
• “Your most recent SOC 2 Type II report.” They know the difference and they want the operating effectiveness assertion. Common from enterprise security teams, fintech counterparties, and anyone touching regulated data. A Type 1 alone will not finish this conversation.
• “Your SOC 2, or your plan and timeline.” This is a soft ask, and it is the easiest of the three. A Type 1 in flight plus a dated written commitment to Type 2 usually clears it inside a week.

Ask, if you are unsure. “Will a Type 1 satisfy your review for this contract?” is a normal question, security reviewers answer it, and a five minute reply can save you a three-month observation window you did not need. The mechanical difference between the two reports is covered in Type 1 versus Type 2.

Six weeks, week by week

This is a calendar against a real date, not an average. It assumes one person can give the work ten hours a week and that your stack is the ordinary one: AWS or Google Cloud, GitHub, Google Workspace. Nothing here needs a consultant.

1. Week one: scope, gaps, policies. You answer a readiness questionnaire, connect your cloud and source control, and get back a deterministic gap list plus thirteen policies written against your actual stack rather than a template pack. Scope to Security only unless a contract names another category.² This is the week you can already tell the customer something true.
2. Week two: close what is configuration. Enforce multi-factor authentication, turn on logging and retention, protect the main branch, run the access review, write the incident response contacts down. Most first-time gaps are settings, not projects. By the end of this week you can name your observation date to the buyer.
3. Weeks three and four: build the binder. Every control gets its evidence attached and mapped to the criteria it satisfies. Screenshots, exported configuration, ticket links, signed policy acknowledgements. The package then goes to the independent partner auditor with the observation date fixed.
4. Weeks five and six: the examination. The CPA firm reviews the package, comes back with questions, and issues the report. An examination of this size typically runs one to two weeks once the evidence is complete. You forward the report the day it is issued.

Two things move that calendar, and neither is the software. Evidence you cannot produce because the control was never operating, and a scope you set wider than the contract requires. On the platform side you are audit-ready starting at about a week; the rest of the six weeks is your own remediation and the examination itself. The same phases without a deal date attached to them are broken out in how long a SOC 2 actually takes, and how it works covers the sequence from the product side.

What is genuinely out of reach

You cannot compress a Type 2.

It rests on a 3-month observation window at minimum, because the auditor tests samples from a period that has to have actually happened.³ Nobody sells a shortcut around that, and any vendor implying otherwise is telling you something you can check. If the contract truly requires Type 2, say so in week one and negotiate the date, or sign with a commitment clause instead.

A sales cycle costs a week you do not have

Buying fast is its own line item. On a deadline you need a number today, and most of this market will not give you one without a call first. These were opened and read on the date shown.

• Vanta lists four plans on its pricing page and no dollar figure. The call to action is to request personalized pricing. Source, checked 2026-07-30.
• Secureframe lists three plans on its pricing page and no dollar figure. Each one links to a quote request. Source, checked 2026-07-30.
• Drata has no public pricing page. The URL serves the homepage, where the calls to action are to contact sales or book a demo. Source, checked 2026-07-30.
• Suralink publishes no price, stating that every company and team has different needs and inviting prospects to reach out. Source, checked 2026-07-30.

A demo, a discovery call, a quote and a redline is a week of your six spent before any work starts. Our price is on the page and the checkout is self-serve for that reason. The full breakdown, with the auditor fee separated out, is on the cost page.

What to send while the examination is in progress

Never say a report exists before it does. One sentence of stretch here is what kills the deal two weeks later, when the reviewer asks for the PDF and there is not one. A buyer who has run vendor reviews before can tell a company mid-examination from a company improvising.

This is the note that works. Send it from the account owner, not from a shared inbox.

It names a date, it names the standard, and it hands the reviewer something to evaluate this week instead of a promise. That last part is the one that moves. Most security reviews have a conditional path for vendors mid-examination, and reviewers use it when the evidence in front of them is real.

The questionnaire that arrives with it

A security questionnaire usually lands in the same thread. Two hundred rows in a spreadsheet, sometimes a portal, always a due date. Answer it in parallel, not after.

Most of the answers are already sitting in the policies you are writing for the examination, which is why doing both at once costs less than doing them in sequence. Do not guess. A wrong yes becomes a finding later, and an honest “not yet, here is the compensating control and the date it lands” is almost never the answer that loses a deal. The gaps that show up most often on a first pass are listed in five common control failures, and they are the ones worth fixing before the questionnaire goes back.

What not to promise

There is no SOC 2 certificate. There is a report, and it carries an opinion for a named date or a named period.¹ Anyone who reviews these documents for a living notices the difference immediately, and the correction lands at the worst possible moment in the deal.

Two more to avoid. Do not send a draft report to a customer; a draft carries no opinion and the auditor has not finished with it. And never name an issue date the CPA firm has not agreed to. A missed date you invented is worse than the original gap.

After this deal closes

The Type 1 gets you through this one. The next enterprise buyer, or this same buyer at renewal, will ask for the Type 2, and the observation window can start the day after your Type 1 date. Keep collecting evidence rather than stopping, and the second report costs you attention instead of a scramble.

Type 2 monitoring is $600 per month on a 12-month term, or $6,000 on one invoice for the first year, two months free versus paying monthly. Each examination is $5,000, including the first, and it becomes available once the 3-month observation window completes. Plan that now, while somebody is paying attention to security at your company. Once the contract is signed, that attention goes somewhere else.