It usually arrives as a flat statement. Your buyer's procurement team says they need your SOC 2 report before the contract can move, and your champion relays it as settled fact. The deal is otherwise done.
So you start pricing audits, and the numbers are unpleasant. Commonly quoted figures run into the tens of thousands of dollars once readiness work, tooling, and the audit itself are counted, and the calendar is worse than the cost: a Type II report requires an observation window, which means months of evidence before an auditor can say anything at all.
Meanwhile the deal is sitting there.
Here is how to work out whether you actually need the report, or whether you need something else entirely.
What the buyer is really asking for
Almost nobody wants your SOC 2 report because they enjoy reading SOC 2 reports. They want three things:
- A description of how you operate — what you do with their data, who can reach it, what happens when something goes wrong.
- Somebody other than you saying it is true. Self-reported answers carry less weight than answers a third party examined.
- A defensible decision. Whoever approves you has to be able to show they did something reasonable if it goes badly later.
A SOC 2 report is one way to deliver all three at once. It is not the only way, and for a lot of deals it is not the proportionate way.
First, find out if it is a requirement or a preference
This is the single most valuable question in the conversation, and it is rarely asked directly: is a SOC 2 report a contractual requirement for this agreement, or is it the way your security team usually gets comfortable?
The answers differ more than people expect.
It is usually a hard requirement when it is written into the master agreement or the security addendum, when your buyer is in a regulated industry passing obligations down to you, when you will hold regulated data, or when their procurement policy has a documented exception process that is more painful than the audit.
It is often a preference when the request came from a reviewer rather than the contract, when nobody can point to the clause requiring it, when the deal is below the threshold that triggers their strictest review, or when the buyer's own team admits they "usually ask for it."
Preferences can be satisfied with alternatives. Requirements cannot, and knowing which one you are facing determines whether you spend $30,000 or a fortnight.
What to offer instead, when it is a preference
If the requirement is soft, the goal is to give the reviewer enough to write down a defensible decision without an audit report. In practice that means some combination of:
- A completed security questionnaire, answered accurately, with evidence attached rather than promised.
- Your written policies — access control, incident response, vendor management, business continuity. These need to exist as documents, not as habits.
- Recent independent testing, such as a penetration test report or a vulnerability scan summary, with what you fixed.
- A call between your senior security representative and theirs. This is often worth more than everything else combined, because a reviewer can ask follow-up questions and hear whether the answers hold up.
- A written roadmap, if you have genuinely decided to pursue an audit, naming what exists today and what is planned — without a promised certification date.
Reviewers accept this more often than founders expect, particularly when the alternative is losing a vendor they already chose on the merits.
The thing nobody tells you before you buy the audit
A SOC 2 report does not end security questionnaires.
Vendors with current reports still receive them, because the report answers the auditor's questions rather than this particular customer's, and because many buyers are obligated to collect their own answers regardless of what certifications you hold. Expect the report to shorten the conversation, not to replace it.
Two more things worth knowing before you commit. The scope is yours to choose — a report covering only the Security criteria is a different undertaking from one covering Availability, Confidentiality, Processing Integrity and Privacy, and buyers rarely specify which they want until you ask. And an audit is a recurring cost, not a one-time purchase: the report has a period, and when that period lapses you are back where you started.
When the answer is genuinely yes
Pursue the audit when the pattern is structural rather than a single deal:
- The same requirement has now blocked or slowed several deals, not just this one.
- You are moving deliberately upmarket, and the next tier of customers will all ask.
- A signed agreement obliges you to obtain one, or your largest customer's renewal depends on it.
- Your buyers are consistently in regulated sectors that pass their obligations down the chain.
In those cases the audit stops being a cost of one deal and becomes a cost of the market you have chosen. The right move then is to start it deliberately — scope it, fix the gaps, and set the observation window — rather than under deadline pressure from whoever is shouting loudest.
What not to do while the deal is live
Do not promise a date. "We'll have SOC 2 by Q2" is easy to say into a stalled deal and very hard to walk back. Your timeline depends on your readiness, your auditor's availability, and an observation window that may not have started.
Do not buy a compliance platform to make the question go away. Tooling helps a program you have already decided to run. It does not substitute for one, and a platform bought mid-deal usually ends up half-implemented.
Do not claim to be "SOC 2 compliant" when you are not. There is no such status — there is a report, covering a defined scope and period, issued by an audit firm. Claiming otherwise in writing is the kind of thing that surfaces later, under worse circumstances.
The short version
Ask whether it is required or preferred. If it is preferred, answer thoroughly, put your senior security person on a call, and offer evidence instead of a certificate. If it is required, or if the same blocker keeps appearing, start the audit deliberately and scope it to what your buyers actually ask for.
What you should not do is spend six months and tens of thousands of dollars to answer a question nobody has confirmed was mandatory.
If you are in that conversation right now and not sure which one it is, that is exactly what a 30-minute deal-readiness call is for. If the questionnaire is already in your inbox, Security Questionnaire Rescue starts at $1,500.