The SOC 2 in progress notice, with the email and the questionnaire answer
Three pieces with one set of facts: the stage you are in, what is finished, when the report is expected, and what a customer can have today.
A SOC 2 in progress notice template gives you the words to send while your examination is under way: which stage you are in, what is finished, when you expect the report, and what a customer can have today. It never calls the company compliant, certified or ready before a report is issued.
It comes as three pieces with one set of facts: a one page customer notice, a short email, and the answer to “Do you have a SOC 2 report?” on a security questionnaire.
SOC 2 in progress announcement email template
The notice, the email and the questionnaire answer are below, with a table of the stages and the wording each one allows. Fill the brackets once and copy the same facts into all three. Each piece has a worked example for a twelve person software company in its first Type 2 observation period.
[Company name]
SOC 2 In Progress Notice
- Contains
- A customer notice, an email and a security questionnaire answer
- Sent by
- [Company name] management
- Dated
- [Notice date]
- Update
- Whenever the stage, a date or a fact in it changes
1. How to use this template
Three pieces, one set of facts: a one page notice for customers, a short email, and the answer to "Do you have a SOC 2 report?" on a security questionnaire. Fill in the same brackets in all three so they never disagree.
Pick the stage in section 2 that is true today and use only the wording that stage allows. The pieces below are written for the observation period of a Type 2. For another stage, replace the stage paragraph with the "may say" wording for that stage.
A SOC 2 report is an attestation report issued by an independent licensed CPA firm under the AICPA attestation standards. There is no certification. Until the firm issues its report, nothing in these pieces may describe the company as compliant, certified or ready.
2. Choose the stage that is true today
| Stage | What is true | What you may say | What you may not say |
|---|---|---|---|
| Readiness work | Gaps are being closed. No CPA firm is engaged. | We are doing SOC 2 readiness work and plan to engage a CPA firm by a stated month. | Any report date, or that an audit or examination is under way |
| Examination engaged | A licensed CPA firm is engaged and the scope is agreed. | A SOC 2 examination is engaged, with its type, scope and planned dates. | That any period is being examined yet |
| Observation period running | A Type 2 period has started and controls are operating. | Our Type 2 observation period runs from a start date to an end date, and we expect the report in a stated window. | That the controls have been tested or found effective |
| Fieldwork under way | The CPA firm is testing. | Testing is under way for the stated date or period, and the report is expected in a stated window. | That the auditors have signed off, or that the report is done |
| Report issued | The firm has issued its report. | We have a SOC 2 Type 1 or Type 2 report, available under a confidentiality agreement. | Nothing here: send the report, and later a bridge letter |
3. The customer notice: our SOC 2 status
[Company letterhead]
[Notice date]
Our SOC 2 status
[Company name] is in a SOC 2 [Report type] examination of its [System name] system, covering the trust services criteria for [Categories in scope]. The examination is performed by [CPA firm], an independent licensed CPA firm. Our observation period runs from [Period start] to [Period end], and we expect the report in [Expected report window]. That date is an expectation rather than a commitment, because the firm decides when it issues its report.
| Item | Status |
|---|---|
| Security policies | Approved on [Policies approved on] |
| Controls | Operating as written since [Controls operating since] |
| Type 1 report | [Issued, with its as-of date, or not issued] |
| Type 2 observation period | [Period start] to [Period end] |
| Expected Type 2 report | [Expected report window] |
What we can provide now:
- Our security policies, approved on [Policies approved on].
- A summary of our controls, mapped to the trust services criteria, operating since [Controls operating since].
- Our SOC 2 Type 1 report, if one has been issued. [Delete this line if not.]
- A call with [Security contact] to walk through how the controls run.
We will send the report on the day it is issued, under a confidentiality agreement, and we will tell you ourselves if the expected window moves. This notice is a statement by [Company name] management. It is not a SOC 2 report and not an opinion of a CPA firm.
[Signer name], [Signer title], [Company name]
3.1 Worked example
A twelve person software company on AWS, in its first Type 2 observation period, would write the stage paragraph like this: "We are in a SOC 2 Type 2 examination of our scheduling platform, covering the Security criteria. The examination is performed by an independent licensed CPA firm. Our observation period runs from April 1 to September 30, and we expect the report in the fourth quarter. That is an expectation rather than a commitment, because the firm decides when it issues its report. Our security policies were approved in March, and our controls have operated as written since April 1. We have not received a Type 1 report."
4. The email version
Subject: Our SOC 2 status
Hi [Recipient name],
Thanks for sending your security review. We do not have a SOC 2 report yet. We are in a SOC 2 [Report type] examination by [CPA firm], an independent licensed CPA firm, covering [Categories in scope] for [System name]. Our observation period runs from [Period start] to [Period end], and we expect the report in [Expected report window], subject to the firm's issuance.
Until then we can share our security policies, a summary of our controls mapped to the criteria, and a call with [Security contact]. We will send the report the day it is issued.
[Signer name], [Signer title]
5. The security questionnaire answer
5.1 Do you have a SOC 2 report?
Not yet. A SOC 2 [Report type] examination by [CPA firm], an independent licensed CPA firm, is in progress, covering [Categories in scope] for [System name]. Observation period: [Period start] to [Period end]. Expected report: [Expected report window], subject to the firm's issuance. Available now: approved security policies, a control summary mapped to the trust services criteria, and a walkthrough call. We will provide the report on issuance.
5.2 Are you SOC 2 certified?
SOC 2 does not produce a certificate. It produces an attestation report from an independent licensed CPA firm. Our examination is in progress and the report is expected in [Expected report window].
5.3 Worked example
"Not yet. A SOC 2 Type 2 examination by an independent licensed CPA firm is in progress, covering the Security criteria for our scheduling platform. Observation period: April 1 to September 30. Expected report: fourth quarter, subject to the firm's issuance. Available now: approved security policies, a control summary mapped to the trust services criteria, and a walkthrough call with our chief technology officer."
6. Words these pieces never use
Each phrase on the left describes a report or a certificate that does not exist yet. The right column says the true thing instead.
| Instead of | Write |
|---|---|
| We are SOC 2 compliant | We are in a SOC 2 [Report type] examination by [CPA firm], and we expect the report in [Expected report window]. |
| We are SOC 2 certified | SOC 2 produces an attestation report from an independent licensed CPA firm, not a certificate. Ours is expected in [Expected report window]. |
| We are SOC 2 ready | Our readiness work has [number] open items, to be closed by [date]. |
| Our auditors have signed off | Testing is complete and the report has not been issued yet. |
| A SOC 2 badge or logo on the website | One line of plain text naming the stage and the expected report window. |
7. When to update or withdraw it
- When the stage changes: rewrite the stage paragraph and redate all three pieces the same day.
- When the expected window moves: tell every customer who received the old date before they ask.
- When a control stops operating during the observation period: do not keep sending a notice that says the controls operate as written. Say what lapsed and when it resumed.
- When the report is issued: withdraw the notice and send the report. After the report period ends, a bridge letter covers the months until the next report.
8. Fields to complete
Replace every bracketed field in this document with your own detail, then delete this section.
| Field | What to enter |
|---|---|
| [Company name] | Your legal company name. |
| [System name] | The product or service the report covers. |
| [Period start] | For a Type 2 report, the first day of the period. |
| [Period end] | For a Type 2 report, the last day of the period. |
| [Signer name] | The officer signing for management. |
| [Signer title] | Their title, printed under the name. |
| [Categories in scope] | For example the Security category. |
| [Report type] | Type 1 or Type 2, as the report states it. |
| [CPA firm] | The firm that issued, or is performing, the examination, named exactly as on its engagement letter or opinion. |
| [Security contact] | The role and email address a reader writes to with questions. |
| [Expected report window] | A month or a quarter, written as an expectation. The CPA firm decides when it issues the report. |
| [Notice date] | The day the notice is sent. Change it every time a fact in it changes. |
| [Controls operating since] | The first day the controls ran as written, with records to show it. |
| [Policies approved on] | The day the approver signed the current security policies. |
| [Recipient name] | The person the notice or email is addressed to. |
Why it never says compliant or certified
A SOC 2 report is an attestation report. An independent licensed CPA firm examines the controls and issues an opinion on them, under the AICPA attestation standards.12 Nothing is certified, and until the opinion exists there is nothing to be compliant with in the sense a reader takes from the word. Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.
The logo follows the same rule. The AICPA offers its SOC logo to service organizations that have received a SOC report from a licensed CPA, so a company still under examination does not qualify.3 The template replaces the badge with one line of plain text.
Keeping the three pieces honest
- Name the stage that is true today. Readiness work is not an examination, and an engaged examination is not a period under test.
- Give a window, not a date. A month or a quarter, called an expectation, because the CPA firm decides when it issues.
- Offer what exists. Approved policies, a control summary and a call with the person who runs security. A Type 1 report only if one has been issued.
- Report a lapse yourself. If a control stops operating during the observation period, the notice stops saying the controls operate as written.
The guide to what to tell customers while SOC 2 is in progress walks through each stage and what can be marketed before the report. The rest of a questionnaire is covered row by row in the security questionnaire answer library. Once the report is issued and its period ends, the months after it are covered by a SOC 2 bridge letter.
Questions
Can I tell customers my SOC 2 is in progress?
Can I say we are SOC 2 compliant before the report is issued?
What should a SOC 2 in progress email say?
How do I answer a security questionnaire while SOC 2 is in progress?
Can I put a SOC 2 logo on our website while the audit is in progress?
When should the notice be updated?
Sources
Get audit-ready without a compliance team.
The readiness assessment is free, with no payment and no card. Star is $2,000 one time to get on the platform and close your gaps. Orbit is $7,800 a year, and your SOC 2 Type 2 audit is included in every contract year. You can be audit-ready starting at about a week.
Take the free assessmentPolara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.