A hypothetical deal: an AE is on a second call with a mid-market buyer, and the IT director asks whether the product is secure. The AE says, "Yes, we're SOC 2 certified." Three weeks later the buyer's security analyst opens the report and finds a Type I, dated fourteen months ago. Now the AE has a credibility problem on top of a security question.

Nothing in that answer was malicious. It was just wrong in two ways that security teams notice straight away: SOC 2 isn't a certification, and a Type I isn't what most of them were hoping to see. The SOC 2 questions buyers ask follow a predictable path, and if you know that path you can keep the deal moving without pretending to be the security team.

How a security review usually unfolds

It starts with a request for the report. Sometimes it's a line in an email from your champion, sometimes it's procurement opening a vendor-onboarding ticket. Either way they want the actual SOC 2 report, not a badge on your homepage.

Next comes the NDA. SOC 2 reports describe internal controls in detail, so vendors rarely send them freely. Many companies host the report in a trust center built on tools like Vanta, Drata or SafeBase, where the buyer requests access and accepts a click-through NDA. If your company doesn't have one, the report usually goes out after a mutual NDA is signed, and you should know in advance whether legal, security or you sends that NDA.

After that, the questionnaire. Larger buyers often send a standard one: the SIG (Shared Assessments' Standardized Information Gathering questionnaire) or the Cloud Security Alliance's CAIQ. Others send their own spreadsheet. Your security team will often answer large parts of these by pointing at sections of the SOC 2 report.

Last come the follow-ups, usually from an analyst who has read the report closely and wants clarification on scope, exceptions, or how old the report is.

The timing is where reps lose deals. Picture the same hypothetical deal again: the AE never asks about security review in discovery, the questionnaire lands at week eight, security needs three weeks to work through it, and a quarter-end signature becomes next quarter's. Asking "Will your security team need to review us, and do they use a standard questionnaire?" on the first or second call costs nothing.

The terms that come up, briefly

SOC 2 is an attestation framework from the AICPA: an independent CPA firm examines a company's controls against the Trust Services Criteria and issues a report. When a vendor calls itself "SOC 2 compliant," it means it holds a current report from that auditor, not that it passed a certification exam. The criteria cover security (always in scope) plus, at the company's choice, availability, processing integrity, confidentiality and privacy. The AICPA's SOC suite overview is the primary source.

A Type I report checks that controls were designed properly at a single point in time. A Type II checks that they actually operated over a review period, usually 6-12 months, sometimes as short as 3. Security teams generally want Type II. If you only have a Type I, say so plainly and, if you know it, say when the Type II period closes.

What you can answer on the call

You can confirm that a report exists, which type it is, and which criteria it covers, provided someone in security has told you. You can explain the access process: "It's in our trust center; request access there and you'll get it once the NDA is accepted." You can tell the buyer which questionnaires your team already has completed versions of, if any, because many vendors keep a pre-filled SIG or CAIQ ready.

You can also explain a bridge letter. A report covers a fixed period, so if that period ended months ago, the buyer will ask what's happened since. A bridge letter (or gap letter) is the vendor's own statement covering the time between the end of the audit period and now. This typically surfaces right before signature, when procurement checks dates on every document. If you've already asked your security team whether a bridge letter exists, you can answer that request the same day.

The buyer may also ask about your cloud provider. A provider like AWS is a subservice organization, and auditors handle it in one of two ways. Under the carve-out method, the provider's controls are excluded from your report, and the buyer reviews the provider's own SOC report separately (AWS publishes its reports through AWS Artifact). Under the inclusive method, the provider's relevant controls are included in your report. Carve-out is common. Knowing which method your report uses saves a round of email.

What goes to security

Scope boundaries, exceptions the auditor found, encryption details, penetration test results, incident history, and any security clauses in the contract. These answers end up in writing and sometimes in the agreement itself.

Don't improvise. Route it to security, tell the buyer who will answer and by when, then make sure it happens.

Before your next deal hits review

Find your company's trust center link and save it somewhere you can paste it in ten seconds. Ask security three things: report type and period end, whether the report is carve-out or inclusive for your cloud host, and whether a bridge letter is available. Then practise the bridge-letter exchange out loud, since it's the question that most often arrives at the worst moment. A hypothetical version:

Procurement: Your report period ended in March. Can you cover the gap? You: Yes, we have a bridge letter through last month. I'll send it today alongside the report.

VoiceVocab's technical sales training has short drills for exchanges like this one, so the answer comes out cleanly when procurement asks.