# How to answer a security questionnaire without SOC 2 By The Citesheet team · Published October 20, 2026 Short answer Answer truthfully. Say No (or Partially) where that is the fact, then explain the controls you do have, point to your written policies, and give a plan with dates. Offer a pen test summary and a call. Buyers can work with an honest No and a credible plan. An answer you can't back up is the bigger risk. You can answer a security questionnaire without SOC 2\. Most of the questions are about what you actually do, not about whether an auditor has signed off on it. The rule is simple: **never claim a control you can't show.** Say No where No is the truth, explain what you do instead, and give a plan with dates. ## What SOC 2 is, and why its absence isn't the end of the deal A SOC 2 report is the result of an examination by a CPA firm of a company's controls over [security, availability, processing integrity, confidentiality and privacy](https://www.aicpa-cima.com/resources/download/get-description-criteria-for-your-organizations-soc-2-r-report). A Type 2 report also tests whether those controls worked over a period of time. That period is [generally 6, 9 or 12 months](https://linfordco.com/blog/soc-2-type-2-report/), so a young company often can't have one yet, even if it started today. Buyers know this. A questionnaire like the [CAIQ](https://cloudsecurityalliance.org/articles/what-is-caiq) (261 questions in v4) exists partly so they can assess vendors who have no report. Your job is to make that assessment easy and honest. ## Rule 1: say No truthfully The most common question in the SOC 2 row is some version of "Do you have a current SOC 2 Type 2 report?" Answer it plainly: > **No.** We have not completed a SOC 2 audit. Our controls are documented in written policies, which we can share under NDA. See the notes below for what is in place today. Don't write "In progress" unless you have signed with an auditor. Don't write "SOC 2 compliant." Without a report, there is nothing to be compliant _with_ in the buyer's eyes, and the phrase reads as a dodge. The same goes for every other row. A small SaaS founder asked r/cybersecurity how to answer [without overstating maturity](https://reddit.sentinel-team.org/posts/1tve84w/snapshots/2026-06-05T22%3A07%3A22.18711Z). The replies agreed on the main point: saying "we don't do that" is more respectable than a stretched answer. Commenters also listed common mistakes. These included claiming controls you can't evidence, answering from intent instead of evidence, and forcing a Yes or No when the honest answer is "partially implemented". Use three answers, not two: | Answer | When to use it | Example | | --------- | ---------------------------------- | ------------------------------------------------------------------------------------------------------- | | Yes | It is in place and you can show it | "Yes. MFA is enforced for all staff on Google Workspace and AWS. See Access Control Policy, section 3." | | Partially | Some of it is in place | "Partially. Production data is encrypted at rest. Backups are not yet encrypted; planned for Q1 2027." | | No | It is not in place | "No. We do not run a formal annual access review yet. Admin access is limited to two named founders." | ## Rule 2: describe compensating controls A compensating control is what you do instead of the formal control. Buyers care about the risk, not the label. If you have no SOC 2 but you do have the basics, say so in the notes column, with specifics: * **Access:** SSO and MFA for every staff account. Production access limited to named people. * **Encryption:** TLS in transit. Your cloud provider's encryption at rest, and which service it is. * **Infrastructure:** Hosted on a major cloud provider. Their SOC 2 covers the data center and physical layer, not your application. Say exactly that, and no more. * **Logging:** What is logged, where, and for how long. * **Backups:** How often, where, and when you last tested a restore. * **People:** Background checks (or not), security training, offboarding steps. Be concrete. "We take security seriously" answers nothing. "Two people have production access, both with hardware security keys" answers the question. ## Rule 3: write the policies down Many questions ask "Do you have a documented policy for X?" If the answer is No only because nothing is written down, write it down. That doesn't mean writing it for the questionnaire. Write down what you really do. A short, true policy beats a long template you don't follow. Buyers often ask for the policy itself, and a mismatch between the policy and the questionnaire is the fastest way to lose trust. Start with the ones that come up most: information security, access control, incident response, data retention and deletion, vendor management, and business continuity. Date each one and name an owner. ## Rule 4: give a roadmap with dates "Planned" means nothing without a date. For each No that matters, give a target: > **No.** We have not completed a SOC 2 audit. We plan to begin a Type 1 examination in Q2 2027\. Until then, we can share our security policies and our most recent penetration test summary under NDA. Only give dates you intend to keep. The buyer may write them into the contract, and the next questionnaire from the same buyer will check. ## Rule 5: offer evidence a buyer can check Without a SOC 2 report, other evidence carries more weight. The r/cybersecurity replies listed [audit reports, pen test summaries, policies, architecture diagrams and config screenshots](https://reddit.sentinel-team.org/posts/1tve84w/snapshots/2026-06-05T22%3A07%3A22.18711Z). Useful items, roughly from strongest to weakest: 1. **A penetration test summary** from an outside firm, with the date and what was fixed. 2. **Your written policies**, shared under NDA. 3. **An architecture diagram** showing where customer data lives and who can reach it. 4. **Screenshots** of key settings: MFA enforcement, encryption, backup schedules. 5. **Your cloud provider's reports**, clearly labeled as covering their layer, not yours. ## Rule 6: offer a call Put one line at the top of the questionnaire or in your reply email: "Happy to walk your security team through any No or Partially answer on a 30-minute call." A security reviewer with a question will often pass a vendor who explains clearly. One who has to guess may not. A call also lets you hear which gaps actually matter to this buyer. ## What buyers usually accept This depends on the buyer, the deal size and the data you'll touch. Ask the buyer if you're unsure. In practice: * **Low-risk deals** (no sensitive data, small contract): honest answers, basic controls and written policies are often enough. * **Medium-risk deals:** expect follow-up questions, a request for policies and a pen test, and maybe a call. * **High-risk deals** (regulated data, large enterprise): some buyers require a SOC 2 report or ISO 27001 certificate before signing. Others accept a dated plan and contract terms that require it later. Ask early, before you spend weeks on the rest of the process. ## What not to do * Don't copy another company's answers. They describe someone else's controls. * Don't let a tool or a chatbot guess. An answer with no source is a claim you will have to defend later. * Don't leave cells blank without a note. Write "No" or "Not applicable" and say why. * Don't promise in a questionnaire what you wouldn't sign in a contract. ## How Citesheet helps Citesheet fills your Excel questionnaire, such as a CAIQ, only from your own policies, with a word-for-word quote behind each answer. Where your documents don't prove a control, it writes "No proof found", so you get a gap list to answer honestly or fix. ## Sources 1. [AICPA & CIMA: SOC 2 description criteria (SOC 2 examination, trust services categories)](https://www.aicpa-cima.com/resources/download/get-description-criteria-for-your-organizations-soc-2-r-report) (accessed October 20, 2026) 2. [Linford & Co: SOC 2 Type 2 reports guide (May 22, 2024)](https://linfordco.com/blog/soc-2-type-2-report/) (accessed October 20, 2026) 3. [r/cybersecurity: How should small SaaS teams safely answer customer security questionnaires?](https://www.reddit.com/r/cybersecurity/comments/1tve84w/) (accessed October 20, 2026) 4. [Archived copy of the same thread (third-party snapshot of June 5, 2026)](https://reddit.sentinel-team.org/posts/1tve84w/snapshots/2026-06-05T22%3A07%3A22.18711Z) (accessed October 20, 2026) 5. [Cloud Security Alliance: What is CAIQ? (Sept 1, 2021)](https://cloudsecurityalliance.org/articles/what-is-caiq) (accessed October 20, 2026) ## Related * [Security questionnaire, no SOC 2 yet?A customer sent a security questionnaire and you don't have SOC 2\. Answer honestly from your own policies, and see exactly which gaps to fix.](https://citesheet.com/security-questionnaire-without-soc-2/) * [What is SOC 2?SOC 2 is an audit report from an independent CPA firm on a service company's security controls. Type 1 vs Type 2, the five categories, and what it means for questionnaires.](https://citesheet.com/glossary/soc-2/) * [Can you use ChatGPT for security questionnaires?ChatGPT can draft security questionnaire answers, but it can invent controls, and uploaded policies follow different data rules by plan. How to use it more safely.](https://citesheet.com/guides/chatgpt-for-security-questionnaires/) * [Vendor security questionnaires: what they are and how to answer them fastWhat a vendor security questionnaire is, the common formats (CAIQ, SIG, HECVAT, custom Excel), and how to answer one quickly without overclaiming.](https://citesheet.com/vendor-security-questionnaire/) * [We tested Citesheet on GitLab's public CAIQHow Citesheet did on a 261-question CAIQ filled only from GitLab's public policies: what matched, what it refused, what it got wrong, and the limits.](https://citesheet.com/benchmark/) ## Send one questionnaire. See the proof. First questionnaire free. Same-day turnaround. Tell us where to send it back and we'll reply with next steps. Send your first questionnaire free Takes about 15 seconds. Or email [hello@citesheet.com](mailto:hello@citesheet.com). Need an NDA first? Ask, and we'll sign before you send anything.