A SOC 2 Request Is Different than a SOC 2 Report
Why evidence has to be collected while controls run, not the month before the audit.
A SOC 2 request is a deadline. A SOC 2 report is the output of months of controls operating with evidence attached. If a buyer asks for your Type II report and you have not started collecting evidence, the fastest honest path is to name your system, start collecting evidence from your tools now, and draft the report as you go. Start free, no card.
The line in the questionnaire
It usually arrives as one row in a procurement spreadsheet:
"Please provide your most recent SOC 2 Type II report."
That line tells you what the buyer wants. It does not tell you which system is in scope, which Trust Services Criteria apply, what observation period the report should cover, or who on your team owns each control. Those are the questions that decide whether you can answer in a week or in a year.
This often lands on founders, first security hires, and engineering leads at seed to Series B SaaS companies with no GRC person. The instinct is to treat it as a document request. It is a request for proof that controls ran over time.
Why it is a different job
A Type I report covers the design of controls as of a specific date. A Type II report covers design and operating effectiveness over a period, and includes the auditor's tests and results. (AICPA, 2017 Trust Services Criteria)
Worse yet, Type II evidence cannot be backfilled. If the access review did not happen in March, no screenshot taken in September makes it have happened in March.
Four ways teams get stuck
Common failure modes:
- Evidence gathered at the end. Screenshots collected in the last few weeks, with no timestamps tied to the observation period.
- Controls with no owner. Nobody notices when a control stops operating, because nobody was watching it.
- Policies written for design only. The Type I policy set exists. Nothing shows the controls ran (the Type II gap).
- Systems missing from the system description. Including AI agents and tools that touch production or customer data.
Why the obvious tools fall short
A policy template pack tracks intent. A spreadsheet tracks a plan. Neither shows a control operating on a given date.
A scanner produces findings. Findings are useful, but they are not control evidence. An auditor testing an access control wants the review record: who reviewed, what changed, when.
What the framework actually asks
SOC 2 is an attestation engagement performed by a licensed CPA firm under AICPA standards. The output is a report with the auditor's opinion. It is not a certification.
Controls are evaluated against the AICPA Trust Services Criteria (TSP section 100, 2017, with revised points of focus, 2022). Security is always in scope, and its common criteria (CC1 through CC9) apply to every SOC 2 report. Availability, Processing Integrity, Confidentiality, and Privacy are added when your commitments call for them.
Observation periods for Type II vary. Teams commonly cite somewhere between 3 and 12 months; your auditor and your buyers decide what is acceptable. Do not plan around a single required length.
A better order
First, name the system in scope and write the system description. Include the AI agents and tools that read or write production data. If an agent can change access or move customer data, it belongs in the description.
Second, collect evidence per control from the tools as it happens: connectors, agents, and uploads. Put an owner on every open item.
Third, draft the report continuously. Gaps should show up months before the auditor does, not during fieldwork.
One control, end to end: access review
Control statement: User access to production systems is reviewed quarterly, and access that is no longer needed is removed.
Evidence item: A quarterly access review export showing the reviewer, the review date, the accounts reviewed, and the changes made.
Owner: A named engineering lead, with a backup.
What missing looks like:
- In week 6, the first quarterly review is not due yet. The open item shows an owner and a due date. Nothing is broken.
- In week 26, two quarters have passed. If one review is missing, it is a gap in operating effectiveness for that period. You find out now, while you can fix the process for the rest of the period, instead of from the auditor.
That is the difference collection-as-you-go makes. The control did not get easier. The gap got visible earlier.
Where UnitOne fits
UnitOne Compliance collects evidence through connectors, agents, and uploads, tracks open items by control with an owner, and drafts the auditor report. Free covers one product (one SOC 2 system in scope), two people, and a draft auditor report you can review in full, and it never expires. Team is $99 per month (excl. tax) and adds the final auditor report you can download and share. Reports are product outputs to help your own compliance work. They are not an audit opinion, an attestation, or a certification. See pricing and UnitOne Compliance.
Selling into the EU as well? The CRA reporting side is a different job. See the CRA Article 14 security evidence checklist.
The hard part
The hard part of SOC 2 is rarely the controls. It is proving they ran.
If a buyer just asked for your report, start the evidence clock today. Start free, no card.