SOC 2 in progress: what to tell customers while you wait

The pressure usually shows up mid deal, when a prospect's security team asks for the report and the work has started, so it feels fair to round up. Do not. Reviewers want to know two things: does a report exist, and if not, when will it. Precise answers to those two questions keep deals alive, while warm but vague ones come back to bite months later.

Match your words to your stage

In progress can mean four quite different things, and a reviewer knows that, so a fuzzy claim earns a follow up question you were hoping to avoid. Find your row and use its wording.

Fieldwork is the strongest spot short of a finished report, so state it precisely. Name the report type and the date or period under examination.¹ That one detail answers most follow ups before they are asked.

A status note you can copy

Keep it short and factual. A reviewer will paste it straight into their vendor file, so write it to survive that. Here is a version for the fieldwork stage. Swap in your own dates.

The note answers five things in order: what is happening, who is doing it, what it covers, when it ends, and what the buyer can see today. Keep the line about the firm deciding the issue date, because it is the sentence that protects you if the schedule moves.

Phrases to swap before you hit send

Each line on the left describes a document that does not exist yet. Each line on the right is true today and still reads well to a reviewer.

Certified is the word that gives people away. SOC 2 is an attestation, and what you receive is a report carrying an opinion.² A reviewer who has read a few reports spots the word at once. cybersoftware is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Readiness work is not a report

Readiness work matters, but it does not prove anything to a third party. It is you measuring your own controls against the Trust Services Criteria.³ It shows what exists, what is only written down, and what is missing. No independent firm has tested it, so it says nothing about whether a control actually ran.

Share it as a gap list and a plan if the buyer wants detail, but never present it as a stand in for a report. And if you have not measured yet, do that first, because without a measurement any date you give a buyer is a guess.

What that measurement costs

Outside firms charge real money for a readiness assessment. Two published figures:

• Secureframe states that a professional SOC 2 readiness assessment typically costs between $10-17,000, and that cost depends on the size of your organization and the scope of your audit. Source, checked 2026-09-01.
• IS Partners, an audit and advisory firm, states that a professional SOC 2 readiness assessment can cost anywhere between $10,000 to $17,000, and that the assessment itself can take anywhere from a few weeks to a few months. Source, checked 2026-09-01.

You can do this step yourself for nothing. Our free readiness assessment scores your answers against the criteria an examination uses and returns the gap list. It takes about 15 minutes. That list is what turns a vague in progress line into one you can defend.

How soon a real report can exist

A Type 1 is an opinion on whether your controls were designed properly on one date, so no operating period has to pass first. The limit is how ready you are and when the firm can schedule you. Once your gaps are known, audit-ready starting at about a week of focused work is a reasonable planning figure.

A Type 2 is a different animal. It covers a window during which your controls actually ran, and that window has a minimum length. Urgency does not shorten it. That is the honest answer when a buyer wants a Type 2 inside one quarter. The SOC 2 timeline breaks down what each date depends on, and a customer asking for a report you do not have covers the contract side of that talk.

On cost: the software is $199 a month, cancel any time, or $2,189 a year, pay for eleven months, get twelve. Audits go through our preferred pricing program, and we negotiate the fee on your behalf, and you see the price in your account before you book, so a real report reaches the buyer without a separate platform contract.

Answer the questionnaire in the meantime

The report request often arrives with a spreadsheet attached. Fill it in. A completed questionnaire is an actual artifact, signed by you, and for a mid-market buyer it can carry the review on its own while the examination runs. It costs nothing but an afternoon.

Answer as if you were under examination. Where a control exists, say so and name the evidence you would produce, and where it does not, say that too, with the date you expect it. Three honest gaps with dates hold up in diligence. A sheet with zero gaps invites someone to go looking, and they will find the ones you left out.

The same question returns later

Issuance does not retire this problem. It comes back each time a report period ends and the next examination has not closed. The standard answer for that gap is a bridge letter, and it follows the same rule as everything above. Say what you know, date it, and assert nothing that was not examined.

Two low effort habits help. Keep the status note as a living document instead of rewriting it under pressure each time, and log every date you give a buyer so you can tell them yourself if one moves. Buyers forgive a slipped date they hear about early.

Your next step

If you cannot yet say which stage you are in, start with the free readiness assessment. You get a readiness assessment, score, gap list and one AI sample policy, which is enough to put a defensible date in your status note. When the buyer needs an actual report, compare the monthly and yearly plans on the pricing page.