How to answer a SOC 2 questionnaire
Published · Qlara
A SOC 2 questionnaire asks about controls relevant to a service organisation and may request a SOC 2 report as supporting evidence. SOC 2 is an attestation reporting framework, rather than an ISO-style certification. A questionnaire response should distinguish the organisation's own report from controls or reports supplied by its infrastructure providers.
Describe the report accurately
When a buyer requests a report, identify the covered service, the report type, the applicable criteria, and its date or review period from the report itself. A Type I report addresses controls at a point in time; a Type II report also addresses their operating effectiveness over a period.
Do not claim that a provider's report covers your organisation's controls. If your organisation has no SOC 2 report, state that accurately and provide the control evidence the buyer is willing to accept.
Questions extend beyond having a report
Buyers may ask about logical access, change management, monitoring, incident response, backups, and availability. Each answer needs evidence for the requested service, even if a report is available.
A request for both RTO and RPO requires the correct pair of targets. A question about backup rotation requires the rotation period, not an unrelated recovery objective. Keep evidence-specific values intact when summarising a longer policy.
Handle supporting material deliberately
Audit reports and related attachments may be restricted. Follow your organisation's sharing rules and the buyer's confidentiality arrangements; do not publish a sensitive document merely to answer a question.
- Confirm the product and assessment scope with the buyer.
- Check report type, coverage, and period against the actual report.
- Collect current operational policies and any requested follow-up evidence.
- Review each draft for unsupported claims and incomplete values.
- Return approved answers with the buyer's evidence-ID convention where one is defined.
Using Qlara
Qlara supports the supplier response workflow by drafting from approved knowledge and exposing citations and evidence gaps for human review. It does not issue SOC 2 reports, perform an attestation, or remove the need for a qualified auditor.
Qlara itself holds no SOC 2 report. Its public Security page describes its hosting and processing providers separately from Qlara's own status.