SOC 2 in progress: what to tell customers while you wait

The pressure usually shows up mid deal, when a prospect's security team asks for the report and the work has started, so it feels fair to round up. Do not. Reviewers want to know two things: does a report exist, and if not, when will it. Precise answers to those two questions keep deals alive, while warm but vague ones come back to bite months later.

Match your words to your stage

In progress can mean four quite different things, and a reviewer knows that, so a fuzzy claim earns a follow up question you were hoping to avoid. Find your row and use its wording.

Fieldwork is the strongest spot short of a finished report, so state it precisely. Name the report type and the date or period under examination.¹ That one detail answers most follow ups before they are asked.

Three blocks to copy

Keep each block short and factual. A reviewer will paste it straight into their vendor file, so write it to survive that. Change the bracketed parts and nothing else. If no CPA firm is engaged yet, swap the examination sentence for: “We are doing SOC 2 readiness work and have not engaged a CPA firm yet. We plan to engage one by [month].” That version is true. The other one would not be.

The email to the customer

The paragraph for your security page

The questionnaire answer

Each block answers five things in order: what is happening, who is doing it, what it covers, when it ends, and what the buyer can see today. Keep the line about the firm deciding the issue date, because it is the sentence that protects you if the schedule moves. The rest of the spreadsheet is covered row by row in how to answer a security questionnaire before you have a report.

Phrases to swap before you hit send

Each line on the left describes a document that does not exist yet. Each line on the right is true today and still reads well to a reviewer.

Certified is the word that gives people away. SOC 2 is an attestation, and what you receive is a report carrying an opinion.² A reviewer who has read a few reports spots the word at once. cybersoftware is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Can you market SOC 2 before the report is final?

You can market the engagement. You cannot market the outcome.

A line saying an independent CPA firm is examining your controls, with the expected report date, is a fact the engagement letter proves. A line saying you are SOC 2 compliant claims an opinion nobody has issued. The Federal Trade Commission states the general rule simply: advertising has to be truthful and not deceptive, advertisers need evidence behind their claims, and claims online are held to the same standard.⁴ A homepage banner, a launch post and a sales deck all count as advertising here.

The logo has a rule of its own. The AICPA offers a SOC logo for service organizations, and its page says the logo may be used by a service organization that has received a SOC 1, SOC 2 or SOC 3 report from a licensed CPA.⁵ No report, no logo. A home made badge that looks like one has the same problem: it tells a visitor something was issued when it was not.

So the honest announcement before the report is the security page paragraph above, posted where buyers look and updated the day the report lands. If a buyer wants to know what the finished document will hold, send them to what a finished SOC 2 report looks like rather than anything of yours. Once yours exists, they can check that a SOC 2 report is real before relying on it.

Readiness work is not a report

Readiness work matters, but it does not prove anything to a third party. It is you measuring your own controls against the Trust Services Criteria.³ It shows what exists, what is only written down, and what is missing. No independent firm has tested it, so it says nothing about whether a control actually ran.

Share it as a gap list and a plan if the buyer wants detail, but never present it as a stand in for a report. And if you have not measured yet, do that first, because without a measurement any date you give a buyer is a guess.

What that measurement costs

Outside firms charge real money for a readiness assessment. Two published figures:

• Secureframe states that a professional SOC 2 readiness assessment typically costs between $10-17,000, and that cost depends on the size of your organization and the scope of your audit. Source, checked 2026-10-02.
• IS Partners, an audit and advisory firm, states that a professional SOC 2 readiness assessment can cost anywhere between $10,000 to $17,000, and that the assessment itself can take anywhere from a few weeks to a few months. Source, checked 2026-10-02.

You can do this step yourself for nothing. Our free readiness assessment scores your answers against the criteria an examination uses and returns the gap list. It takes about 15 minutes. That list is what turns a vague in progress line into one you can defend. The SOC 2 evidence checklist then shows what the firm will ask you to produce once it starts.

How soon a real report can exist

A Type 1 is an opinion on whether your controls were designed properly on one date, so no operating period has to pass first. The limit is how ready you are and when the firm can schedule you. Once your gaps are known, plan on being audit-ready starting at about a week of focused work. The examination itself then usually takes one to two weeks.

A Type 2 is a different animal. It covers a window during which your controls actually ran, and that window has a minimum length. Urgency does not shorten it. That is the honest answer when a buyer wants a Type 2 inside one quarter. How long SOC 2 takes breaks down what each date depends on, and a customer asking for a SOC 2 report you do not have covers the contract side of that talk.

On cost: cybersoftware publishes one price for the Type 1 path. $4,000 one time covers onboarding and a SOC 2 Type 1 examination by an independent licensed U.S. CPA firm, with the auditor fee included. Onboarding alone is $2,000 one time. What the same report costs elsewhere, with the auditor fee split out, is on how much SOC 2 costs.

Answer the questionnaire in the meantime

The report request often arrives with a spreadsheet attached. Fill it in. A completed questionnaire is an actual artifact, signed by you, and for a mid-market buyer it can carry the review on its own while the examination runs. It costs nothing but an afternoon.

Answer as if you were under examination. Where a control exists, say so and name the evidence you would produce, and where it does not, say that too, with the date you expect it. Three honest gaps with dates hold up in diligence. A sheet with zero gaps invites someone to go looking, and they will find the ones you left out.

The same question returns later

Issuance does not retire this problem. It comes back each time a report period ends and the next examination has not closed. The standard answer for that gap is a bridge letter, and it follows the same rule as everything above. Say what you know, date it, and assert nothing that was not examined.

Two low effort habits help. Keep the three blocks above as one living document instead of rewriting them under pressure each time, and log every date you give a buyer so you can tell them yourself if one moves. A slipped date you report first is a schedule change. One the buyer finds on their own is a trust problem.

Your next step

If you cannot yet say which stage you are in, start with the free readiness assessment. Free. No payment and no card. It returns a score and a gap list, which is enough to put a defensible date in your status note. When the buyer needs an actual report, see both entry options on the pricing page.