Customer asking for SOC 2 report? Read the ask first

Four answers keep a deal moving this week. Ask which one the reviewer will accept.

1. A Type 1 with a date. Engage a CPA firm for a Type 1 and put the control date and the expected report month in writing. The phases behind that date are in how long SOC 2 takes.
2. A written Type 2 date. When the buyer wants a Type 2, commit in writing to when the observation window starts and when the report is expected. The wording for both is in what to tell customers while SOC 2 is in progress.
3. A signed security questionnaire. Your own answers, signed by you, with honest gaps and the dates they close. How to answer a security questionnaire has the rows that recur.
4. A contract clause. The contract commits you to deliver the report by a date, with a remedy if you miss it. This one needs your lawyer and the buyer’s, and it moves the security review off the signing path.

Before any of those, you still have something to send: a scoped control set, written policies, and an evidence binder mapped to criteria that a security reviewer can be walked through on a call. That is what the reviewer can evaluate before a report exists. If a report already exists and has simply lapsed, the answer is different, and it is a bridge letter.

It shows up as one line in a long email. Legal is done, the order form is sitting in somebody’s inbox, and the security review needs your SOC 2 before anything moves. Nobody at your company has seen a SOC 2 report. The customer’s date does not move.

Two questions matter now, in this order. What will physically exist on the deadline, and will this particular buyer accept it? Average phase durations answer a third question, which is no use to you while a contract sits unsigned.

Read the ask before you buy anything

Procurement teams write “SOC 2” without saying which one. The wording tells you which product you actually need, and the gap between the two is months of calendar time. Here are three phrasings and what each one means.

• “Send us your SOC 2.” No further detail, no version named. A Type 1 clears this. The reviewer is closing a checklist item and wants to see a signed opinion from a licensed CPA firm with your company name on it.
• “Your most recent SOC 2 Type II report.” They know the difference and they want the operating effectiveness assertion. Common from enterprise security teams, fintech counterparties, and anyone touching regulated data. A Type 1 alone will not finish this conversation.
• “Your SOC 2, or your plan and timeline.” This is a soft ask, and it is the easiest of the three. A Type 1 in flight plus a dated written commitment to Type 2 usually clears it inside a week.

Ask, if you are unsure. “Will a Type 1 satisfy your review for this contract?” is a normal question, security reviewers answer it, and a five minute reply can save you a three-month observation window you did not need. The mechanical difference between the two reports is covered in Type 1 versus Type 2.

Six weeks, week by week

This is a calendar against a real date, not an average. It assumes one person can give the work ten hours a week and that your stack is the ordinary one: AWS or Google Cloud, GitHub, Google Workspace. Nothing here needs a consultant.

1. Week one: scope, gaps, policies. You answer a readiness questionnaire, connect your cloud and source control, and get back a deterministic gap list plus thirteen Security policies written against your actual stack rather than a template pack. Scope to Security only unless a contract names another category.² This is the week you can already tell the customer something true.
2. Week two: close what is configuration. Enforce multi-factor authentication, turn on logging and retention, protect the main branch, run the access review, write the incident response contacts down. Each of these is a setting, not a project. By the end of this week you can name your observation date to the buyer.
3. Weeks three and four: build the binder. Every control gets its evidence attached and mapped to the criteria it satisfies. Screenshots, exported configuration, ticket links, signed policy acknowledgements. The package then goes to the independent partner auditor with the observation date fixed.
4. Weeks five and six: the examination. The CPA firm reviews the package, comes back with questions, and issues the report. An examination of this size typically runs one to two weeks once the evidence is complete. You forward the report the day it is issued.

Two things move that calendar, and neither is the software. Evidence you cannot produce because the control was never operating, and a scope you set wider than the contract requires. On the platform side you are audit-ready starting at about a week; the rest of the six weeks is your own remediation and the examination itself. The same phases without a deal date attached to them are broken out in how long a SOC 2 actually takes, and how it works covers the sequence from the product side.

What is genuinely out of reach

You cannot compress a Type 2.

It rests on an observation window, because the auditor tests samples from a period that has to have actually happened.³ Polara starts a first Type 2 on a 3-month observation window, the shortest window the partner auditor accepts for a first Type 2, not an AICPA rule, and a buyer can ask for longer. Nobody sells a shortcut around that, and any vendor implying otherwise is telling you something you can check. If the contract truly requires Type 2, say so in week one and negotiate the date, or sign with a commitment clause instead.

A sales cycle costs a week you do not have

Buying fast is its own line item. On a deadline you need a number today, and most of this market will not give you a firm one without a call first. These were opened and read on their own pages.

• Vanta lists four plans on its pricing page and no dollar figure. The call to action is to request personalized pricing. Source.
• Secureframe lists its Fundamentals plan as starting at $7,500 a year and shows no dollar figure for its other two plans, Complete and Defense. Every plan links to a quote request. Source.
• Drata lists its compliance plans, Foundation, Advanced and Enterprise, on a plans page with no dollar figure, and each plan button leads to a demo request. Source.
• Suralink publishes no price, stating that every company and team has different needs and inviting prospects to reach out. Source.

A demo, a discovery call, a quote and a redline is a week of your six spent before any work starts. Our number is published for that reason, and the checkout is self-serve. Through Polara Labs, Star is $2,000 one time for onboarding, and a Type 1 report is $2,000 more, with the Type 1 examination and the engagement fee for the independent partner auditor inside it. On a deadline you want both. That is the whole quote. The full breakdown, with the auditor fee separated out, is on how much SOC 2 costs, and the side by side with the two largest vendors is in the Vanta alternative and Drata alternative comparisons. Before committing to a date, the free readiness assessment tells you how many gaps stand between you and the examination, which is what the deadline actually depends on.

What to send while the examination is in progress

Never say a report exists before it does. One sentence of stretch here is what kills the deal two weeks later, when the reviewer asks for the PDF and there is not one. A buyer who has run vendor reviews before can tell a company mid-examination from a company improvising.

This is the note that works. Send it from the account owner, not from a shared inbox.

It names a date, it names the standard, and it hands the reviewer something to evaluate this week instead of a promise. That last part is the one that moves. Ask whether their review has a conditional approval for a vendor mid-examination. If it does, this note is what they need to use it.

The questionnaire that arrives with it

A security questionnaire usually lands in the same thread. Two hundred rows in a spreadsheet, sometimes a portal, always a due date. Answer it in parallel, not after. The twelve that recur, with answer text for before and after a report exists, are in how to answer a security questionnaire.

Most of the answers are already sitting in the policies you are writing for the examination, which is why doing both at once costs less than doing them in sequence. Do not guess. A wrong yes becomes a finding later, and an honest “not yet, here is the compensating control and the date it lands” is an answer a reviewer can work with. Five gaps worth fixing before the questionnaire goes back are listed in five common control failures.

What not to promise

There is no SOC 2 certificate. There is a report, and it carries an opinion for a named date or a named period.¹ Anyone who reviews these documents for a living notices the difference immediately, and the correction lands at the worst possible moment in the deal.

Two more to avoid. Do not send a draft report to a customer; a draft carries no opinion and the auditor has not finished with it. If the reviewer wants to know what the finished document will contain, show them what a finished SOC 2 report looks like instead. And never name an issue date the CPA firm has not agreed to. A missed date you invented is worse than the original gap.

After this deal closes

The Type 1 gets you through this one. The next enterprise buyer, or this same buyer at renewal, will ask for the Type 2, and the observation window can start the day after your Type 1 date. Keep collecting evidence rather than stopping, and the second report costs you attention instead of a scramble.

Orbit is $7,800 a year, and it carries the audit itself: your SOC 2 Type 2 audit is included in every contract year, and each one starts once the 3-month observation window completes. Plan that now, while somebody is paying attention to security at your company. Once the contract is signed, that attention goes somewhere else.

Renewals need nothing extra. Orbit renews at $7,800 with your annual audit included.