The five criteria
SOC 2 is organised around the trust services criteria: security (required in every report), availability, processing integrity, confidentiality and privacy. A SOC 2-shaped questionnaire follows the same five headings. Security asks about the whole control environment: governance, risk, access, change, monitoring, incident response. Availability asks about capacity, backups, continuity and recovery objectives. Processing integrity asks whether the system does what it says, completely and accurately. Confidentiality asks how confidential information is identified and protected. Privacy asks about personal data: notice, choice, retention, disposal.
If you have a report
Send it under NDA, with a bridge letter if the report period ended more than a few months ago. Be ready for questions about the exceptions the auditor noted, the complementary user entity controls (the things the report assumes the customer does), and the sub-service organisations carved out of the report, typically your hosting provider. A questionnaire that arrives alongside a report request is usually short; answer the rows the report does not cover and refer to the report section for the rest.
If you do not
Answer by criterion. For security, the answers are the same ones every questionnaire asks for: access control, change management, vulnerability management, logging, incident response, with owners, frequencies and evidence. For availability, give your recovery objectives, backup schedule and the date of the last restore test. For confidentiality, the classification scheme and the encryption in place. For privacy, the DPA, the sub-processor list and the retention rules. A vendor without a report but with specific answers and evidence is accepted by most customers; the report becomes worth its cost when the same questionnaire arrives every week.
The answers that overlap with ISO 27001
Most of the security criterion overlaps with ISO 27001's Annex A. If you keep one approved answer per control, the same answers serve a SOC 2 questionnaire and an ISO one; only the headings differ. Responsemate drafts a questionnaire in either shape from the same library, and shows on each row which entry it used. Questionnaires in Responsemate.
Questions people ask
What is the difference between SOC 2 Type I and Type II?
A Type I report describes your controls and whether they were suitably designed at a point in time. A Type II report tests whether they operated over a period, usually six to twelve months. Customers who ask for "your SOC 2" almost always mean Type II.
Can a European company get a SOC 2 report?
Yes, from any auditing firm licensed to issue them. Many European companies choose ISO 27001 or an ISAE 3000 report instead because their customers ask for those; some hold both when they sell to the US.
Is a SOC 2 report enough to skip the questionnaire?
Often it shortens it. Customers with a mature process read the report, note the exceptions, and send a short questionnaire on what the report does not cover: your specific service, data flows, and anything since the report period.