Why a SOC 2 report does not end the security questionnaire

Does a finished SOC 2 report get you out of answering security questionnaires? Usually not — and the reason is structural rather than bureaucratic.

The two documents are built differently, they answer to different readers, and each leaves a gap the other is expected to fill. Treating the report as the finish line is what makes questionnaires painful.

They are not two versions of the same thing

A security questionnaire is your own assertion. You write the answers. Nobody outside your company has checked them before they land in the buyer's file. Its scope is whatever the buyer decided to ask about, which routinely runs well past anything in your report: contract terms, insurance limits, where data physically sits, how many hours before you send a breach notice, which subprocessors you added last quarter.

A SOC 2 report is the document whose conclusion you did not write. Your side describes the system; the firm doing the work reaches its own conclusion about what it looked at. In our view that separation is the whole of the document's weight with a buyer. The scope is settled when the engagement is scoped rather than when the buyer asks, and the work is finished before the report reaches anyone.

The differences that do the work:

	Security questionnaire	SOC 2 report
Who asserts it	You	An independent firm, about your description
Who sets the scope	The buyer	Agreed when the engagement is scoped
Points at	Today, as you answer	Work that finished before you sent it
Where it binds	Frequently the contract	The conclusion itself

Neither is a weaker version of the other. Each does something the other cannot.

What a report genuinely closes

Much of a standard questionnaire is addressed somewhere in a period report, and the useful move is to find out exactly where, once.

Access management, change management, logging, encryption, vendor oversight, incident response, backup and recovery — these recur in almost every questionnaire and in almost every SOC 2 report. When your answer can point to the report section, the reviewer's job becomes verification rather than interrogation, and the exchange gets much shorter.

The second thing a report closes is the credibility question. An answer reading "access is reviewed quarterly" and a report section showing that an outside firm went and looked at those reviews are not comparable evidence. The difference is the whole subject of how to run an access review an auditor will accept.

Which report you hold matters here as well, because the two kinds do not carry the same weight in a questionnaire exchange. SOC 2 Type 1 vs Type 2 sorts out which one you have and what it can support. If the request came from a controller rather than a security team, SOC 1 vs SOC 2 is the check to run first.

What a report cannot close

Scope. The report covers a named system. Questionnaires arrive attached to a specific purchase, and buyers regularly find that the product they are buying is not the system the report describes.

Timing. A report speaks to work that closed before it reached the buyer. A questionnaire asks about now. That gap is where a reviewer's follow-up questions live, and it widens every month after issuance.

What was carved out, and what was pushed back. Reports commonly exclude parts of a service delivered by other providers, and commonly assume controls the customer operates at their own end. Both move work back across the table, and a careful reviewer asks about both.

Everything the contract owns. Cyber insurance limits, subprocessor notice periods, contractual notification hours, data residency, indemnities, whether a particular region can be excluded from processing. These are commercial and legal terms, and in our view they belong to the agreement and to the people who negotiate it, not to a document you forward.

The buyer's own obligations. This is the large one, and it is why clean reports do not end the conversation.

Why the questions keep coming anyway

The buyer is usually not being difficult. They are often discharging a duty of their own, and your report is an input to it rather than a substitute.

The buyer's task is about their exposure, not your maturity. NIST's glossary defines a supply chain risk assessment as "a systematic examination of supply chain risks, likelihoods of their occurrence, and potential impacts," a definition drawn from NIST SP 800-53 Rev. 5. Likelihood and impact are properties of the buyer's situation, not yours. A supplier's document is one input to that examination, not the examination itself.

Some buyers are told to ask, in writing, and then to ask again. For the financial institutions the FTC's Safeguards Rule covers, the FTC's guidance says to "select service providers with the skills and experience to maintain appropriate safeguards," and adds that "your contracts must spell out your security expectations, build in ways to monitor your service provider's work, and provide for periodic reassessments of their suitability for the job." Periodic reassessment is why the spreadsheet comes back even when nothing about you has changed. The same guidance tells covered institutions to "implement multi-factor authentication for anyone accessing customer information on your system" — which is why that question appears whatever your report says — and expects the designated Qualified Individual to report in writing at least annually to the board. Whether the rule reaches a given buyer is a question for their counsel rather than for your sales team.

Some buyers are told to read the report and then keep going. The 2023 interagency guidance on third-party relationships from the Federal Reserve, the FDIC and the OCC says a banking organization "may consider reviewing System and Organization Control (SOC) reports" — and then weigh "whether the scope and the results of the SOC reports, certifications, or assessments are relevant to the activity to be performed or suggest that additional scrutiny of the third party or any of its contractors may be appropriate." The same guidance explains why the follow-up questions keep arriving: "A banking organization is responsible for conducting its activities in compliance with applicable laws and regulations, including those activities involving third parties. The use of third parties does not abrogate these responsibilities."

Public-company buyers carry the incident on their own books. In its 2023 cybersecurity disclosure release, the SEC was direct: "whether an incident is material is not contingent on where the relevant electronic systems reside or who owns them." Material incidents are generally disclosed on Form 8-K "within four business days of determining an incident was material." If your outage becomes their filing, they will want more than last year's document.

One detail in that release raises the questionnaire's importance rather than lowering it. The Commission noted that the final rules "generally do not require that registrants conduct additional inquiries outside of their regular channels of communication with third-party service providers pursuant to those contracts and in accordance with registrants' disclosure controls and procedures." Your questionnaire answers and your contract are those regular channels — what the buyer relies on when they have four business days and a determination to make.

The same reasoning from the buyer's side of the table is set out in what a vendor risk assessment should actually ask.

The questionnaire is a contract document

Questionnaire responses are frequently referenced in the agreement or attached to it. That makes an overstated answer a commercial exposure rather than a wording problem, and it is worth having counsel confirm how yours are incorporated.

A few disciplines are worth imposing before anything goes out:

• One named owner per answer — the person who would have to produce the evidence if asked.
• No answer that outruns the report. If the report scope excludes a system, the questionnaire answer cannot quietly include it.
• No word for your report that the report does not use for itself. Reviewers who read these documents for a living notice when a company reaches for a grander label, and the reach costs you credibility on every other answer.

Build the answer library once

Most companies answer the same questions repeatedly and start over every time. The fix is unglamorous and pays immediately.

1. Merge the questionnaires you have already received into one list. The overlap is large, and their union is close to the next one you will get.
2. For each question, record the same fields: the answer, where the evidence lives, the report section that supports it if one does, the named owner, and the date it was last reviewed.
3. Mark the questions where the honest answer is "not yet." That list is your roadmap, and it is more useful than the list you can already answer.
4. Re-read the library the week your report is issued. Scope decisions change some answers, and stale entries are how a contradiction reaches a reviewer.
5. Publish the part you are comfortable publishing. A trust page answers the easiest questions before anyone sends them.

Where to start

Sort the questions in front of you into three piles: answered by the report, answered by evidence you hold, and not yet true. Only the third pile needs a decision, and it is smaller than it looks.

The security questionnaire panic checker does that separation for a question set, and the trust page grader shows what a buyer sees before they send you anything. For an ordered view of the gaps behind the third pile, use the readiness scorecard.

This is general information, not audit, security or legal advice. Confirm what applies to you with your auditor or counsel.

Common questions

Does a SOC 2 report replace a security questionnaire?

Rarely. A report will usually shorten the questionnaire, because much of a standard question set maps to sections of the report. It does not remove it, because a questionnaire asks about the present, about the specific product being bought, and about commercial terms such as notification timing and insurance that live in the contract rather than in a document you forward.

Why do buyers keep sending questionnaires after we send a clean report?

Often because they have an obligation of their own. The FTC's Safeguards Rule guidance tells covered financial institutions that their contracts must provide for periodic reassessments of a service provider's suitability, and the SEC has said materiality of an incident does not depend on who owns the affected systems. Your report is an input to their process, not a discharge of it.

Can we describe ourselves as SOC 2 certified on a questionnaire?

In our view, no. Use the word your own report uses for itself, and describe what you hold rather than reaching for a grander label. Experienced reviewers treat the wrong word as a signal that nobody in the company has read the document being sent, and it puts every other answer you gave in doubt.

What should we do about questions the report does not cover?

Answer them directly and separately, and keep them out of the report's shadow. Contract terms, notification hours, subprocessor lists, data residency and insurance limits belong to legal and commercial owners inside your company, and the answer should name evidence a reviewer could actually ask for.

Are questionnaire answers binding in the way a report is not?

They can be. Questionnaire responses are frequently referenced in or attached to the agreement, which means an overstated answer is a commercial exposure rather than a drafting slip. Have counsel look at how your answers are incorporated before you treat the spreadsheet as an informal exercise.

Sources

1. FTC Safeguards Rule: What Your Business Needs to Know · Federal Trade Commission
2. Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure (Release Nos. 33-11216; 34-97989), 88 FR 51896 · U.S. Securities and Exchange Commission, via the U.S. Government Publishing Office
3. Interagency Guidance on Third-Party Relationships: Risk Management, 88 FR 37920 · Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation and Office of the Comptroller of the Currency, via the U.S. Government Publishing Office
4. Computer Security Resource Center Glossary — 'supply chain risk assessment' (definition drawn from NIST SP 800-53 Rev. 5) · National Institute of Standards and Technology