Security questionnaire answers › Governance
What do you say when a customer asks for a SOC 2 report and you don't have one? How to answer it in a security questionnaire
Why buyers ask this
Early-stage companies face this constantly. How you answer decides whether the deal stalls.
What a strong answer includes
- Be honest: say you do not hold a report yet and give your timeline.
- Offer concrete substitutes: a completed questionnaire, policies, a security overview and a call with whoever owns security.
- Show the controls are real with evidence (MFA settings, backups, access reviews).
Sample answer to adapt
Replace the bracketed parts with your own facts. Only state what is true for your environment.
We do not yet have a SOC 2 report; our audit is planned for [date]. In the meantime we can share our security overview, policy set and a completed questionnaire, and we are happy to walk your team through our controls on a call.
Evidence to attach
- Security overview
- Policies
- Completed questionnaire
- Roadmap to audit
Common mistakes
- Overclaiming or dodging the question, which security teams notice quickly.
Answer questionnaires from your own documents
Korrali Trust drafts answers from your policies and evidence so every response traces back to its source, and a person reviews it before it goes out.