Customer asking for SOC 2 report? Your next six weeks

The email looks routine. Legal signed off, the order form is ready, and then one line from security: please send your SOC 2 report. You do not have one. On a six week deadline the answer is a Type 1, a report that can exist by then, and it clears a lot of procurement holds by itself.

Four replies keep a deal moving this week. Ask the reviewer which one they will take.

1. A Type 1 with a date. Engage a CPA firm for a Type 1, then put the control date and the month you expect the report in writing. The phases behind that date are in how long SOC 2 takes.
2. A written Type 2 date. If the buyer wants a Type 2, commit in writing to when the observation window opens and when the report should arrive. Wording for both is in what to tell customers while SOC 2 is in progress.
3. A signed security questionnaire. Your own answers, signed, with honest gaps and the dates they close. How to answer a security questionnaire covers the rows that come up again and again.
4. A contract clause. The contract commits you to deliver the report by a set date, with a remedy if you miss it. Both sides need their lawyers for this one, and it takes the security review off the signing path.

Even before those, you have something to send: a scoped control set, written policies, and an evidence binder mapped to the criteria that a reviewer can be walked through on a call. That is what can be evaluated before a report exists. If you already had a report and it has lapsed, the answer is different: a bridge letter.

Two questions come first. Which report does this buyer actually need? And what can you physically have in hand on their date? Average timelines do not help you here. You need a plan against one specific day.

Find out which report they mean

Procurement often writes “SOC 2” with no type attached. The wording is a clue, and getting it right can save a three month wait you never needed. Here are the three shapes the request takes.

“Please send your SOC 2.”

No type named. A Type 1 usually clears it. The reviewer needs an independent CPA firm’s report with your name on it to tick a box.

“Your latest SOC 2 Type II.”

They know the difference and want proof the controls operated over time. Expect this from large security teams, financial counterparties and anyone handling regulated data.

“Your report, or your plan and timeline.”

The soft version. A Type 1 in progress plus a dated commitment to a Type 2 tends to settle it within a week.

Unsure? Ask. “Would a Type 1 satisfy your review for this contract?” is an ordinary question, and reviewers answer it. Type 1 versus Type 2 explains what each report actually tests.

What unblocking the deal costs

Speed of purchase is part of the cost. On a deadline you need a firm price today, and several vendors in this market will not give one without a call. These were read on the date shown.

• Vanta lists four plans on its pricing page and no dollar figure. The call to action is to request personalized pricing. Source, checked 2026-10-02.
• Secureframe lists its Fundamentals plan as starting at $7,500 a year and shows no dollar figure for its other two plans, Complete and Defense. Every plan links to a quote request. Source, checked 2026-09-28.
• Drata lists its plans, Foundation, Advanced and Enterprise, on a plans page with no dollar figure, and each plan button leads to a demo request or a contact-sales form. Source, checked 2026-10-02.
• Suralink publishes no price, stating that every company and team has different needs and inviting prospects to reach out. Source, checked 2026-10-02.

A demo, a discovery call, a quote and a contract review can eat a week of your six before any work begins. Our price is published and checkout is self-serve for that reason.

You choose one entry at checkout and pay it once. $2,000 one time covers onboarding on its own. $4,000 one time covers onboarding plus the SOC 2 Type 1 examination, with the engagement fee for the independent partner auditor included. On a deadline the second one is the one to buy, and that is the whole quote. See the pricing page, how much SOC 2 costs for the auditor fee split out, or the Vanta alternative and Drata alternative comparisons for the two largest vendors side by side.

A six week plan against the contract date

This plan assumes one person can give the work about ten hours a week, and a common stack: AWS or Google Cloud, GitHub, Google Workspace. You do not need a consultant for any of it. Each block below ends with something you can tell the buyer.

1. Week one: assess and scope. Take the readiness assessment, connect your cloud and source control, and get the gap list plus thirteen policies drafted from your answers. Keep scope to Security unless the contract names another category.² You can now tell the buyer you have started.
2. Week two: fix the settings. Multi-factor authentication, logging and retention, branch protection, an access review, incident contacts. Each of these is a setting, not a project. By Friday you can name the date your controls will be examined as of.
3. Weeks three and four: assemble the evidence. Attach proof to each control and map it to the criteria. Screenshots, exported settings, tickets, signed policy acknowledgments. The package then goes to the auditor.
4. Weeks five and six: the examination. The CPA firm reviews the package, asks questions and issues the report. With the evidence complete, this typically takes one to two weeks. Send the report the day you receive it.

The software side gets you audit-ready starting at about a week. The rest of the six weeks is your own remediation and the examination. Two things stretch it: a control that was never running, and a scope wider than the contract needs. The same phases without a deadline are in how long SOC 2 takes.

What six weeks cannot buy

A Type 2. It rests on a 3-month observation window at minimum, because the auditor samples from a period that has to have happened.³ If the contract truly needs Type 2, say so in week one. Then negotiate the date, or sign with a clause committing to the report.

The note to send while you work

Never say a report exists before it does. That one stretch of the truth comes back two weeks later, when the reviewer asks for the PDF. A reviewer who has done this before can tell a company mid-examination from one that is improvising. Send this from the account owner:

It gives a date, names the standard, and hands the reviewer something real to evaluate this week. Ask whether their review has a conditional approval for vendors mid-examination. If it does, this note is what gets you onto it. If the wording is the harder part, what to say while SOC 2 is in progress goes further.

The questionnaire in the same thread

A security questionnaire tends to arrive alongside the request. Hundreds of rows, a portal, a due date. Answer it in parallel. Your new policies already hold most of the answers, so doing both at once costs less than doing them in turn. How to answer a security questionnaire has answer text for before and after the report exists.

Do not guess. A wrong yes becomes a problem later. An honest “not yet, here is the interim control and the date it lands” is something a reviewer can work with. Five common control failures lists the gaps worth fixing before the questionnaire goes back.

Promises to avoid

There is no SOC 2 certificate. There is a report with an opinion for a date or a period.¹ People who review these for a living notice the wrong word at once, and the correction lands at the worst moment.

Two more. Never send a draft report, since a draft carries no opinion and the auditor has not finished with it. If the reviewer wants to see what the final document will hold, send what a finished SOC 2 report looks like instead. And never give an issue date the CPA firm has not agreed to. A missed date you made up hurts more than the original gap.

After the contract is signed

The Type 1 gets this deal done. The next large buyer, or this one at renewal, will ask for a Type 2, and its observation window can start the day after your Type 1 date. Keep collecting evidence and the second report is routine rather than a scramble.

The SOC 2 Type 2 subscription is $600 a month on a 12-month term, or $6,600 for the year, pay for eleven months, get twelve. The 3-month observation window runs inside that term, and your first SOC 2 Type 2 audit is included in the term. Plan it now, while security has your attention.

If the buyer’s email just landed, start with the number that decides your date. Take the free assessment. It takes about 15 minutes and tells you how many gaps stand between you and the examination.