What to publish once your SOC 2 report arrives
The report arriving is the start of using it, not the end of the project. The first month decides whether it shortens your security reviews or sits in a folder while your team keeps answering the same questions by hand.
Once your first SOC 2 report arrives, publish its existence, not its contents. Put the report type, the criteria and the period on your website or trust centre, offer the full report to customers and prospects under an NDA, update every saved questionnaire answer to reference it, and diary the end of the period so a bridge letter or the next report is ready before buyers start asking.
What should change in the first week?
0 of 0 done ยท
What goes public and what stays behind an NDA?
| Item | Where it goes | Why |
|---|---|---|
| That you hold a report, its type, criteria and period | Public | Answers the first question every reviewer asks |
| A SOC 3 report, if you bought one | Public | General-use by design |
| The full SOC 2 report | Behind an NDA, approved per request | Restricted use; detailed enough to help an attacker |
| Bridge letter | With the report, behind the same NDA | Covers the time since the period ended |
| Management responses to exceptions | With the report | A reviewer should read your answer next to the finding |
| The auditor's name | Check your engagement letter | Some firms set conditions on marketing use of their name |
Who exactly may receive the full report is set by the restricted-use paragraph in the auditor's opinion. GetSOC2 explains it in who can you give your SOC 2 report to. For the full list of sections a trust centre should carry, see what to publish on a trust centre on TrustCenter.
How do you present exceptions?
Do not hide them, and do not let a reviewer find them cold. If the report has exceptions, make sure each has a management response that says what happened, what you changed and when. Many first reports have at least one. A reviewer who reads a clear response next to a minor exception usually moves on; a reviewer who discovers an unexplained one starts asking questions about everything else. If the opinion itself is qualified, that is a different conversation, covered on GetSOC2 under exceptions and qualified opinions.
How do you stop the report going stale?
A Type 2 report covers a period that has already ended by the time you receive it. Buyers want coverage close to today. Three dates matter: the end of the current period, the date you will issue a bridge letter covering the gap, and the start of the next observation window, which should begin the day after the last one ended so coverage is continuous. Put all three in the calendar now. A report more than a year past its period end with no bridge letter reads to most reviewers as a lapse.
The second year is cheaper only if the first one ended cleanly
Evidence collection has to keep running between reports. Teams that stop collecting once the report arrives spend the first months of the next window rebuilding it. The evidence collection guide covers what has to keep running.
Who should run all of this?
Someone has to approve report requests, keep the published material current and answer the follow-up questions the report prompts. In a small company that is usually whoever led the readiness project. If that person is also shipping product, a managed trust centre takes the inbound work off them. TrustCenter compares self-managed and managed options.
Common questions
Can we say we are SOC 2 certified once the report arrives?
No. SOC 2 is an attestation report, not a certification. Say you hold a SOC 2 Type 1 or Type 2 report covering the named criteria, and give the period or date it covers.
Should we buy a SOC 3 report as well?
Buy one if you want something to publish openly or hand to people who only need to know a report exists. Enterprise reviewers will still ask for the SOC 2, so the SOC 3 does not replace the NDA step for them.
How long is a SOC 2 report considered current?
Most reviewers expect the report period to have ended within the last twelve months, with a bridge letter covering the time since. Plan the next report so a new one arrives before the old one passes that point.
Plan your second report now
Describe where you are once and Canadian readiness firms reply with a plan for continuous coverage.
Get matched