Your SOC 2 in progress, and what to tell customers

A prospect asks for your report. You do not have one. The work has started, which feels like it should count for something, and the temptation is to describe it in the warmest language that is technically defensible. Resist that. A security reviewer is reading for one thing: whether a report exists, and if not, when.

The four states, and which ones you may describe

Saying a SOC 2 is in progress can mean four quite different things depending on where you actually are. A vague claim invites the follow-up question you were hoping to avoid. Say which one is true.

Readiness work, no firm engaged

You are closing gaps and collecting evidence. Nothing is under examination. Describe it as readiness work, never as an audit, and do not name a report date you have no engagement to support.

Engaged, examination not started

A licensed CPA firm has been engaged and the scope is agreed. You may say an examination is engaged and give the planned start. You may not describe a period as being examined until it is.

Fieldwork running

The firm is testing. This is the strongest honest position short of a report, and it is the one worth stating precisely: the report type, the date or period under examination,¹ and the expected issuance.

Report issued

Now you have a document. Everything above stops being necessary, and the only questions left are distribution and the period it covers.

Three blocks to copy

Each block is built so a reader can paste it into their own file without editing it. Change the bracketed parts and nothing else. The SOC 2 in progress notice template has all three as a Word and PDF download, with a one page customer notice and a filled example. If no CPA firm is engaged yet, replace the sentence about the examination with: “We are doing SOC 2 readiness work and have not engaged a CPA firm yet. We plan to engage one by [month].” That sentence is true, and the other version would not be.

The email to the customer

The paragraph for your security page

The questionnaire answer

Each block carries five facts in the same order: what is happening, who is doing it, what it covers, when, and what you can offer today. The sentence about issuance being the firm’s decision is the one that protects you if the date slips. The rest of that spreadsheet is covered row by row in how to answer a security questionnaire before you have a report.

What you can say now, and what has to wait

Every sentence in the left column is a claim about a document that does not exist yet. The right column says the same thing truthfully. Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

The certified row is the one a security reviewer reads as a warning. SOC 2 is an attestation engagement and the deliverable is a report carrying an opinion,² so there is no certificate to hold up.

Can you market SOC 2 before the report is final?

You can market the engagement. You cannot market the result.

A sentence saying an independent CPA firm is examining your controls, with the expected report date, is a fact you can prove with the engagement letter. A sentence saying you are SOC 2 compliant is a claim about an opinion nobody has issued. The Federal Trade Commission puts the general rule plainly: advertising must be truthful and not deceptive, advertisers need evidence for their claims, and claims on the internet are held to the same standard.⁴ A homepage banner, a launch post and a sales deck are all advertising for that purpose.

The logo has its own rule. The AICPA offers a SOC logo for service organizations, and its own page says the logo may be used by a service organization that has received a SOC 1, SOC 2 or SOC 3 report from a licensed CPA.⁵ No report, no logo. The same goes for a home-made badge that looks like one: it tells a visitor something has been issued when it has not.

So the honest version of a SOC 2 announcement before the report is the security page paragraph above, posted where buyers look, and updated the day the report lands. If a buyer wants to see what the finished document will contain, point them at what a finished SOC 2 report looks like rather than anything of yours, and once yours exists they can check that a SOC 2 report is real before relying on it.

What readiness work proves, and what it does not

Readiness work is real work. It is not evidence to a third party, and the distinction matters more to your buyer than it does to you.

A readiness assessment is your own measurement of your own controls against the Trust Services Criteria.³ It tells you which controls exist, which are only described, and which have nothing behind them. It carries no opinion from an independent firm, so it proves nothing about whether a control operated. Share it as a gap list and a plan if the buyer wants detail. Do not present it as a substitute for a report.

If you have not measured yet, that is the first thing to fix, because you cannot give a date without it. The free SOC 2 readiness assessment scores your answers against the same criteria an examination uses and returns the gap list, which is what turns a vague in-progress claim into a defensible one. The SOC 2 evidence checklist shows what the firm will ask you to produce once it starts.

When you can first hand over a real report

A Type 1 is an opinion on whether your controls were suitably designed as of a single date. No period of operation has to elapse first, so the constraint is your own readiness and the firm’s schedule rather than the calendar. Once you know your gaps, plan on being audit-ready starting at about a week of focused work.

A Type 2 is different in kind. It covers a window during which controls actually operated, and the window has a floor, so no amount of urgency compresses it. That is the honest answer to a buyer pressing for a Type 2 inside a quarter, and how long SOC 2 takes lays out what each date really depends on. When a contract date is the real constraint rather than the report, a customer asking for a SOC 2 report you do not have is the page for that conversation.

Polara Labs sells the Type 1 path at published prices: Star is $2,000 one time for onboarding, and a SOC 2 Type 1 report by an independent licensed U.S. CPA firm is $2,000 more. What the same report costs elsewhere, with the auditor fee separated out, is on how much SOC 2 costs.

After the report lands

The in-progress problem does not end at issuance. It comes back every time your report period ends and the next examination has not closed, which is a narrower version of the same question with a standard answer attached to it. That answer is the bridge letter, and the rule underneath it is the one on this page: say what you know, date it, and do not assert anything nobody examined.

Two habits are worth building now. Keep the three blocks above as one living document rather than rewriting them under pressure each time. And log every date you give a buyer, so you can tell them yourself when one moves. A slipped date you report first is a schedule change. One the buyer discovers is a trust problem.