All guides

No SOC 2 report? How a small vendor answers the certification question

Say no plainly, show the controls you do have, point to your certified providers, and give a date for any gap.

The question

Most vendor questionnaires ask: "Do you hold any security certifications (SOC 2, ISO 27001)?". For a team of 1 to 25 people the true answer is usually no. That is allowed. The question is part of the questionnaire, not a condition for answering it.

What to say

1. Say no, in the first sentence. Do not write around it. A vague answer reads as hiding something.
2. Name the controls you do have. MFA, disk encryption, automatic updates, backups, access reviews. Send the Security Overview that lists them.
3. Point to the providers that are certified. Your hosting provider's data centres carry their own certifications. Say which provider and link its security page.
4. Give a date for any gap. If you plan a certification, say when. If you do not, say that too.

When the client really requires a report

Some clients write the report into the contract. Ask them in writing: is a report a condition for signing, or is a completed questionnaire enough? Many accept a questionnaire and an overview for a small vendor. If the report is required, you have a clear task and a clear reason to price it, and you can say so to the client.

Do not claim what you do not have

Phrases such as "SOC 2 compliant" or "ISO aligned" without a report invite follow-up questions you cannot answer. Describe controls, not labels.

Where to go next

See the governance questions for the full set of answers in this area, and the 6-step process for the whole questionnaire.

Guidance and templates, not legal advice. The kit does not certify you. Your answers must match what you actually do.