Most SOC 2-aligned vendor assessments — SIG Lite, CAIQ-Lite, custom questionnaires from Fortune 500 procurement — ask the same 15 questions in different orders. This checklist walks through each one, the canonical answer shape, and the artifact you should attach.
If you're new to vendor assessments more broadly, the TPRM glossary entry defines the surrounding workflow, our analysis of why questionnaires still break sales cycles covers the strategic context, and Evident's home page shows the automated alternative.
Before you start
Three documents make SOC 2 questionnaire response faster; missing any of them turns the rest of this checklist into guesswork rather than reference.
- Your most recent SOC 2 Type 2 report (or the audit letter if a Type 1 is all you have)
- The system description section of your SOC 2 report, saved as its own PDF
- A one-page control-mapping sheet that aligns your controls to CC1-CC9
If you don't have those, stop and build them. Every other shortcut assumes they exist.
The 15 questions
In our customer base these fifteen prompts cover most SOC 2-aligned text you will see; canonical phrasings shift, the underlying ask does not.
1. "Is your organization SOC 2 Type 2 certified?"
Answer shape: Yes / No / In progress, plus the report period. Attach: SOC 2 Type 2 report cover + audit letter. (See the TPRM glossary for context on why this question always comes first.)
2. "When was your last SOC 2 audit?"
Answer shape: ISO date. Attach: Nothing — this is reference-only.
3. "Who is your SOC 2 auditor?"
Answer shape: Firm name + partner name if known.
4. "What is the scope of your SOC 2?"
Answer shape: Named products + infrastructure boundaries. Be specific — "our production environment" is an insufficient scope statement.
5. "Do you have a documented information security policy?"
Answer shape: Yes. Attach the policy (or the redacted version).
If your policy is labeled "draft" or "v0.x," ship a v1 before you send this answer. Reviewers notice.
6-15
For the remaining 10 questions on access control, encryption, BCP, vendor management, incident response, awareness training, change management, vulnerability management, data classification, and audit logging — the pattern is the same: yes/no + brief narrative + attachment.
Avoiding the three most common mistakes
These three patterns show up in every vendor-review cycle, and avoiding them is the difference between a fast pass and a re-questionnaire round-trip.
- Inconsistent answers across questionnaires. Central knowledge base, period.
- Stale attachments. Your SOC 2 report is dated; if a reviewer sees a report that expired 4 months ago, they assume your posture has expired too. Re-issue with the current auditor's roll-forward letter.
- "N/A" where you actually mean "yes but scoped." Reviewers read N/A as "they didn't read the question." Write the scoped yes.
Stop answering these questions by hand
Evident's AI responds to SIG, CAIQ, and custom questionnaires using your SOC 2 report and prior answers as ground truth.