Does a SOC 2 Report Replace
Security Questionnaires?

No. It replaces a large share of the questions inside one. Sort the document first, into four kinds: tested-control questions, which a Type 2 answers better than any self-declaration; current-state facts such as the date and scope of the last penetration test; product and configuration questions about what the buyer switches on in their own tenant; and contractual or jurisdictional terms. In the illustrative example on this page, a 284-question bank from an EU bank split into 171 answerable from Section 4, 42 from the contract and the DPA, 38 from product documentation, 19 redirected to complementary user entity controls, and 14 that needed original work.

Usually because a rule or an internal policy requires it, and the rule does not mention SOC 2. GDPR Article 28(3)(h) obliges a processor to make available the information needed to demonstrate compliance and to allow for and contribute to audits; EDPB Guidelines 07/2020 treat third-party certifications and audit reports as one means of verifying a processor’s guarantees rather than a substitute for the contractual audit provision. DORA Article 30 requires processing locations and subcontracting conditions to sit in the written arrangement. NYDFS 23 NYCRR 500.11 and the June 2023 US interagency guidance at 88 FR 37920 require documented, evidenced due diligence of the provider itself.

Answer it directly and show your working, because the reviewer will read Section 4 anyway. Quote the exception language as printed, give the denominator — two of the twenty-five terminations selected were processed outside the stated window, say — and state whether it recurred in a later test or a later period. Point at management’s response in Section 4, noting that it is the service organisation’s own text and carries no assurance from the CPA firm, then say what changed, when it changed, and how you know it held. An exception narrated calmly with a date and a fix reads as maturity; the same exception discovered by the reviewer reads as concealment.

A complementary user entity control is one the report assumes the customer operates. Three recur in almost every multi-tenant SaaS report: administering users inside the customer’s own tenant, reviewing that user list periodically, and notifying the vendor promptly when the customer’s own people leave. They appear in Section 3, and the CPA firm evaluated the described system assuming they exist — and did not test them, since the examination covers neither their design nor their operation. Use one as an answer only where you can cite the CUEC by the number printed in your own Section 3 and hand over the documentation that lets the customer operate it.

No criterion addresses it. The 2017 Trust Services Criteria, with points of focus revised in 2022, say nothing about where data is stored or processed, so a clean opinion carries no residency assurance. A description may name hosting regions when it lists infrastructure components, but that text is descriptive and carries no test result behind it. Send three things instead: the hosting-region page from your product documentation, the annex to your data processing agreement listing processing locations and sub-processors, and the standard contractual clauses module that applies where transfers leave the EEA. For EU financial entities, DORA Article 30 puts processing locations in the written arrangement itself.

Key every entry to its source rather than to the questionnaire it arrived in. Tested-control answers point at a Section 4 criterion and control identifier; boundary answers at Section 3; customer-side answers at a numbered CUEC plus a configuration guide; product answers at documentation and the plan tier it applies to; commitments at a clause in the current contract template; current-state facts at a dated internal register. Give each entry a named owner, a refresh trigger and a confidentiality tier — because quoting exception detail from a restricted-use report into an open portal is a different act from citing a criterion.

No, in three different ways. For GDPR, a report can support the Article 28(3)(h) demonstration while leaving the processing agreement, sub-processor authorisation, transfer safeguards and the audit right in place. For HIPAA, a business associate agreement with satisfactory assurances is required under 45 CFR 164.308(b) and 164.314(a). For PCI DSS, requirement 12.8.4 expects a programme monitoring service providers’ compliance status at least once every twelve months, and the artefact it contemplates is an Attestation of Compliance. A framework mapping appendix in Section 5 is other information accompanying the report; the CPA firm’s opinion does not extend to it.

Frequently, and teams underrate it. Many enterprise agreements incorporate questionnaire responses by reference, converting each answer into a contractual warranty made by whoever filled in the form, usually under a deadline and often without Legal reading it. Check the incorporation clause before anyone starts typing. A report reference carries its own limits with it — a stated period, a described system, named criteria and an independently tested result — so the reader can see exactly what was covered. Where a question outruns what the report shows, “yes, subject to the following” is worth far more than a bare yes.

Send the SOC 3, if you have one. It is a general-use report the CPA firm issues from the same examination, covering the same criteria but omitting the description of tests and results, so it can be published or handed over without a non-disclosure agreement. It answers the threshold question — is there a current examination, by whom, over what period, with what opinion — and buys the time to get a mutual NDA signed before the Type 2 is released. A SOC 3 has to be commissioned; it is a separate deliverable the CPA firm issues on request. SOC 2 reports themselves are restricted-use documents intended for the service organisation, its user entities and other specified parties.

Expect the questionnaire to grow, because the extra questions are filling the uncovered months. Issue a bridge letter: management’s written statement that the description remains accurate and that no material changes to the control environment occurred between the period end and a stated date, usually kept to three months or less. It is management’s representation — the CPA firm performs no procedures over the gap and the letter carries no assurance — so say that plainly and let the reviewer price it in. Pair it with dated current-state evidence covering the gap: the latest scan summary, the most recent access review, and any change to sub-processors or hosting regions.