The questionnaire from Part 2 always ends the same way. Two hundred line items of “do you enforce MFA” and “do you encrypt at rest,” and then the final field: “Attach your SOC 2 Type II report.” Everything before it is you describing yourself. The attachment is a licensed CPA firm describing you — and in procurement, that difference is the whole game. Deals have died over a missing report that no amount of questionnaire answers could resurrect.
The first four parts of this series built the controls: tenant isolation, identity, audit logs, billing integrity. This part is about the document that makes them count in a sales cycle — because “we have the controls” and “an independent firm watched them operate for six months and will put their license behind it” are different sentences, and only one of them closes enterprise deals.
An attestation, not a certificate
The most misunderstood fact about SOC 2: there is no pass and no certificate. SOC 2 is an attestation — a licensed CPA firm audits your controls against the AICPA’s Trust Services Criteria and issues an opinion: unqualified (clean), qualified (mostly clean, with named exceptions), adverse (do not frame this one), or a disclaimer (the auditor couldn’t even form an opinion). Nobody “fails” SOC 2; they just receive a report they wouldn’t want to attach.
Two more structural facts that shape everything:
- Only Security is mandatory. The other four criteria — Availability, Processing Integrity, Confidentiality, Privacy — are scoped in based on what you sell. Confidentiality showing up in 64% of reports in 2024, double the prior year’s rate, is buyers pushing scope, not auditors.
- Type II is the only type that matters. Type I evaluates whether controls are designed correctly on a single day — a photograph. Type II evaluates whether they operated over a period, typically six to twelve months — the film. Enterprise procurement has largely stopped accepting the photograph.
Your buyer’s security team will not read the report cover to cover. They read the opinion, flip to the deviations, and check the subservice provider list. Write your controls and your system description for that reading order.
What the auditor actually samples
The mental model to discard is the exam. A Type II audit is closer to a nature documentary: the auditor doesn’t ask what you can do, they watch what you did — by pulling samples from anywhere in the observation window. Practitioners quote typical sampling: 15–25 instances of a daily control, 2–5 of a monthly one, and 10–20% of the population for per-event controls like onboarding. If your quarterly access review happened twice in a six-month window, both instances will be read.
This is why SOC 2 cannot be crammed. A control that existed for the last two weeks of the window is a control that was absent for the first five months, and the report will say so in the neutral, devastating language of a deviation. The controls that generate evidence as a side effect of existing are the ones that survive — which is the series so far, viewed through an auditor’s eyes:
- Part 1’s tenant isolation becomes access-control and data-segregation evidence.
- Part 2’s SCIM joiner-mover-leaver flow becomes the deprovisioning control, with timestamps.
- Part 3’s audit log export is quite literally an evidence artifact — the auditor will ask for it by name.
- Part 4’s webhook verification and idempotent billing pipeline become change-management and processing-integrity evidence.
The 2022 revision of the AICPA’s points of focus nudged expectations further into modern terrain: MFA and zero-trust language in logical access, infrastructure-as-code as configuration baseline management, data lifecycle documentation, and explicit review of service accounts — the non-human credentials most inventories forget. Auditors in 2026 arrive expecting risk-based authentication, defined RTOs and RPOs, and continuous monitoring. The bar moved while the criteria text didn’t.
The report is a boundary map
Here is the part that surprises first-timers: your SOC 2 report is not only about you. Almost 90% of reports now include subservice providers — your cloud host, your payment processor, your identity vendor — and the standard treatment is the carve-out: their controls are excluded from your audit and covered by their reports. Nobody attests the whole stack. What your report attests is that you know exactly where your responsibility ends and theirs begins, and that you manage the seam.
The seam runs in both directions. Complementary user entity controls — CUECs — are the duties your report assigns to your customers: “the customer is responsible for enforcing MFA on their own users,” “the customer must rotate the API keys we issue.” Your buyer’s auditor reads these as obligations they inherit by signing with you. And you are simultaneously on the receiving end: when you carved out Stripe and AWS, their CUECs became your homework. Reading a vendor’s SOC 2 report — opinion, deviations, CUECs, in that order — is a skill this series assumes from now on. A vendor who can’t produce a report is not automatically disqualified, but the burden of proof just moved to you.
Evidence is a pipeline, not a scramble
The economics in 2026: $30K–$80K all-in for a company’s first Type II (audit fees, readiness work, tooling), three to twelve months from kickoff to issued report, and the observation window is the floor on the timeline — no money compresses six months of evidence into two. This is why the compliance-automation category (Vanta, Drata, and their competitors) exists: not to “do SOC 2 for you,” but to make evidence collection a continuous byproduct instead of a quarterly fire drill. Their core move is wiring into your cloud, identity provider, HR system, and code host to test controls hourly and file the proof automatically. An auditor who receives a year of timestamped, system-generated evidence samples differently — and more kindly — than one handed a folder of screenshots taken last Thursday.
The caution runs the other way too: a green dashboard is not a control. Automation platforms verify configurations; the auditor verifies operation — that a human reviewed the access list, that the change ticket was actually approved before deploy, that the incident channel exists and has history. The tool collects; you still have to do. The teams that treat the platform as the compliance program discover the difference in the deviations section.
Plan for the report as an annual rhythm, not a project: the window for next year’s Type II starts the day this year’s ends. The boring, compounding truth of SOC 2 is that the second report is dramatically cheaper than the first — because the pipeline was already running.
Where the series goes next
Current thinking for the next door: incident response — the day one of these controls fires for real, who gets paged, what gets preserved, and why the first hour decides whether the postmortem is a paragraph or a lawsuit. Abuse and trial-farming — the quieter, continuous attack on your free tier — is the other strong candidate. As before: the order is decided when we get there.
Practice
- Pick one control you claim today — say, “we review production access quarterly” — and produce the evidence for the last two quarters, right now, in under ten minutes. If the answer involves the words “let me find a screenshot,” you’ve found your first automation target.
- Pull the SOC 2 report of one vendor you depend on (your cloud host makes it easy). Find three things: the opinion, the subservice providers they carved out, and the CUECs that are now your job. Write the CUECs down somewhere your auditor will believe.
- Sketch your own carve-out table: every subservice provider your system relies on, which report covers them, and what breaks if their next report ships with a qualified opinion. If the table has a provider you’ve never read a report from, that’s next month’s reading.