Writing a SOC 2 readiness proposal
A readiness proposal is a scope document with a price on it. The buyer is not comparing your methodology, they are trying to work out which of three quotes covers the same work.
A SOC 2 readiness proposal should be four to six pages and readable in ten minutes by somebody who is not technical, because the person signing it usually is not. Seven sections do the work: what they told you, what is in scope, what you deliver, what you do not, the schedule against their report date, the price, and what you need from them. Everything else is filler. The methodology diagram most firms include is the most skipped page in the document.
4 to 6 Pages, including the price
7 Sections that earn their place
48 hours From call to proposal, before the urgency fades
The price comes from how the offer is packaged. The premises come from the qualification call. A proposal written before both are settled is a guess with a cover page.
The seven sections
| Section | Length | What it has to do |
|---|---|---|
| What you told us | Half a page | Their situation in their words, including the customer name and the date. Proves you listened and fixes the premises the price rests on |
| Scope | Half a page plus a table | Systems, environments, trust services categories, report type, window length. This is the section quotes are compared on |
| What we deliver | One page | Named artifacts, not activities. "A policy set of 12 documents" rather than "policy development" |
| What is not included | Half a page | The section that protects the fee. Firms leave it out to seem accommodating and pay for it in month three |
| Schedule | Half a page | Working backwards from their report date, with the window start marked as the constraint |
| Price and terms | Half a page | CAD, stated as such, with the payment schedule and what triggers a change order |
| What we need from you | Quarter page | Named owner, access, and the hours per week you are assuming from their team |
The last section is the one that changes outcomes. Readiness engagements fail because the client did not put in the hours. A proposal saying "we assume four to six hours a week from your engineering owner" turns that from a surprise into a term, and gives you the sentence you need in week five when it is not happening.
The scope table
Put this on page two. Three quotes with three different scope tables are comparable. Three quotes with three narrative scope paragraphs are not, and the buyer defaults to price.
| Dimension | In scope |
|---|---|
| Report type | SOC 2 Type 2 |
| Trust services categories | Security only |
| Observation window | Three months, starting on a stated date |
| Products and services | Named, and only the named ones |
| Environments | Production only, one cloud provider, named |
| Supporting systems | Identity provider, code repository, pipeline, ticketing, named individually |
| Locations and workforce | Remote Canadian staff and contractors, named count |
| Personal information in scope | Whether Quebec residents or health information are included |
| Subservice organizations | Listed, with carve-out or inclusive stated |
| Excluded | Named explicitly, including the staging environment and the legacy product |
Include the two Canadian rows even when the answer is no. The prospect has usually never been asked, and it shows you are pricing against their obligations rather than a US template. Both link back to SOC 2 and Law 25 from the buyer's side.
Why readiness proposals lose
- The scope is written so it cannot be compared
- The most common cause, and self-inflicted. A buyer holding three proposals wants to know which covers more. If yours needs interpretation and a competitor's has a table, yours gets read second.
- It arrived a week late
- Readiness enquiries have a forcing event behind them and urgency decays fast. Forty-eight hours from the call is the standard to beat, and a shorter proposal sent on Tuesday beats a better one sent the following Monday.
- The price has no shape
- One number for everything invites a yes or no rather than a conversation. A phased price, with the assessment separable, lets a buyer who cannot approve $38,000 CAD today approve $9,000 CAD today.
- It promises the audit outcome
- Any wording that implies you guarantee a clean report is unsellable to a careful buyer and legally awkward. Say what you deliver and what it makes possible, not what an independent third party will conclude.
- It reads like it was written for somebody else
- Buyers recognize a template. The half page of what you told us, with their customer's name and their real date in it, separates a proposal from a brochure, and it costs fifteen minutes.
The counter-case for a longer document
Selling into a formal procurement process, or into anything government-adjacent, a four-page proposal reads as insufficient and scores down against a rubric that awards points for sections you left out. Ask early whether there is an evaluation matrix. If there is, write to it and put the short version at the front as an executive summary.
Before you send it
0 of 0 done ·
Should I include a case study?
One paragraph, if it is genuinely similar in size and stack, and only with the client's permission. A generic logo wall does nothing for a buyer who is comparing scope tables, and most readiness clients will not let you name them.
How much detail should the schedule have?
Phases and weeks, not tasks and days. The buyer needs to see that the arithmetic reaches their report date. A thirty-line project plan invites negotiation about individual tasks and will be wrong by week two anyway.
Do I send a proposal or a statement of work?
One document that is both, if you can. A separate statement of work negotiated after the proposal is signed adds two weeks and is where the exclusions get quietly softened. Make the proposal signable.
What if they ask me to cut the price?
Cut the scope with it and say which part came out. Discounting the same scope teaches the buyer that the first number was invented, and it sets the rate for the retainer that follows. Removing the system description or the evidence routine setup is a real change with a real consequence, and explaining that often ends the conversation about price.
List your firm
Proposals are easier when the enquiry arrives with size, timeline and a score already attached.
List your firm