PW-SOC2-005 SOC 2 readiness spoke
What to send procurement in week 2 (questionnaire path)
TL;DR. When you cannot yet attach a SOC 2 report, send a clear in-progress status, security overview, architecture diagram, MFA/encryption statements, subprocessors list, and a filled CAIQ-Lite or SIG-Lite. Honesty about timeline beats a vague “coming soon.”
Week-2 packet contents
- Status letter — scoped categories, Type 1/2 intent, target report month, auditor engaged or shortlisted.
- One-page security overview — hosting, encryption in transit/at rest, MFA, logging, incident contact.
- Architecture diagram — data flow at a level you would show a SE.
- Subprocessors list — current, dated.
- Questionnaire — CAIQ-Lite or SIG-Lite completed from a single source of truth.
- Policies index — titles + last reviewed dates (attach only if asked).
What not to invent
- Do not imply a report date you cannot hit.
- Do not claim certifications you do not hold.
- Do not give conflicting answers across two buyer portals—version your pack.
A real questionnaire is often the right trigger to start SOC 2 in earnest—not a vague “we should get compliant someday.”
Questions founders ask
What if they demand a report this month?
Share status, packet, and the soonest honest date—or walk if the date is impossible.
Should we share draft policies?
Prefer an index; share full policies when requested under NDA.
Is a pen test required in week 2?
Not universally. Send what you have; do not invent.