SOC 2 comes up in almost every security questionnaire, in two ways. First the direct questions: do you have a report, which type, what period, any exceptions. Then dozens of control questions that are really the Trust Services Criteria in different words. If you have a report, it already answers most of them. The work is reading it carefully and answering exactly what it supports.
What SOC 2 questions show up in security questionnaires?
The report itself comes first: its type, period, scope and exceptions. Then come control questions that map to the Trust Services Criteria.
The questions about the report usually look like this:
- Do you have a current SOC 2 report? Type 1 or Type 2?
- What period does it cover, and when is the next one?
- Which Trust Services Categories are in scope: Security only, or also Availability, Confidentiality, Processing Integrity or Privacy?
- Were there exceptions or a qualified opinion?
- Which subservice organizations (your cloud provider, for example) are carved out?
- Can you share the report, and a bridge letter for the time since the period ended?
The control questions are spread across the questionnaire under headings like access control, change management or incident response. Most of them trace back to a common criterion.
Type 1 or Type 2: which do buyers want?
Most buyers want a Type 2, which shows controls operating over a period of three to twelve months. A Type 1 covers a single point in time.
A Type 1 is a fine first step and an honest answer while a Type 2 period is running. Say which one you have, the date or period it covers, and when the next report is expected if you have a real date.
How do SOC 2 controls map to questionnaire questions?
Each common criterion becomes a cluster of questions. Answer each one from the control as your report describes it, and cite where.
Trust Services Criteria in questionnaire language
CC1 Control environment
SOC 2Do you run background checks? Is there a code of conduct? Who owns security?
Cite the HR and governance controls in the system description. Name the owner by role, not by person.
CC3 Risk assessment
Sub-processorHow often do you assess risk? Do you assess your vendors?
Give the cadence your control states, and point to the vendor review control for sub-processors.
CC6 Logical and physical access
MFA, SSO, access reviews, offboarding, encryption at rest and in transit.
Answer each item separately. Access reviews and offboarding have a cadence and a time limit in the control; use those numbers, not rounder ones.
CC7 System operations
Logging, monitoring, vulnerability scanning, incident response, penetration testing.
Cite the incident response plan and the monitoring control. If the pen test isn’t part of the report, say where its evidence lives instead.
CC8 Change management
Are changes reviewed and tested before production? Who can deploy?
Describe review and approval as the control states it, including any emergency change path.
CC9 Risk mitigation
Business continuity, insurance, vendor management.
Answer continuity from the plan and its test, and vendor management from the vendor review control.
A1 Availability
Uptime commitments, backups, disaster recovery testing.
Only if Availability is in scope. If it isn’t, say so and answer from your backup and DR policies directly.
C1 Confidentiality
ISO 27001Data classification, retention and deletion.
Only if Confidentiality is in scope. Otherwise answer from your data retention policy and the DPA.
How do you answer from your report without overclaiming?
Answer only what the report actually tested, name any gaps plainly, and point to other evidence for anything the report doesn’t cover.
- Match the control’s wording. If the control says quarterly access reviews, don’t write “regular” or “continuous.”
- Mind the scope. A Security-only report doesn’t cover Availability or Privacy. Answer those from your policies and say they’re outside the report.
- Be direct about exceptions. If the auditor noted an exception, say what it was and what you changed. Buyers read the report anyway.
- Explain carve-outs. Your cloud provider’s controls are covered by its own SOC 2, not yours. Say so and offer that report.
- Use the bridge letter. If the period ended months ago, a bridge letter covers the time since.
- Point out customer responsibilities. Complementary user entity controls (CUECs) are the things your customer has to do, such as managing their own users. Questionnaires rarely ask, but naming them avoids surprises.
What if you don’t have a SOC 2 yet?
Say so plainly, give a real date only if you have one, and answer the control questions from your policies and other evidence.
Buyers handle “not yet” better than a vague answer that turns into a problem in procurement. Answer each control question from what you actually do, and share policies, a recent penetration test or an ISO 27001 certificate if you have them.
Where does Evident fit?
Evident answers SOC 2 questions from your report and policies, cites the section each answer came from, and leaves unsupported ones open.
Add your SOC 2 report and policies to the Knowledge Base, or sync them from Google Drive, Confluence, Notion or Drata. When a questionnaire arrives, Evident drafts every answer from that evidence with the source attached, so a reviewer can check the claim against the report in one click. Anything your evidence doesn’t cover stays open for your team. On your Trust Center, you decide who can download the report, for how long, and with a watermark.