“Do you have SOC 2?” is rarely the whole ask. Procurement and security teams follow up with a vendor questionnaire — sometimes a SIG Lite, sometimes a 40-tab Excel workbook — even after you share the report. The questionnaire is how they map your controls onto their risk language.
This guide is for founders, security leads, and GTM folks who need to get through that form without a week of archaeology in Google Drive.
SOC 2 report vs SOC 2 questionnaire
Your SOC 2 Type II report is an auditor’s opinion over a period. A vendor questionnaire is the buyer’s checklist for how you operate today — often including topics the report only covers at a high level (subprocessors, data residency, breach notification SLAs, customer-configurable MFA).
Bring both: the report (or bridge letter) and ready answers tied to current policies. A report alone rarely closes the review.
What buyers usually ask (and what evidence maps)
Access & identity
- SSO / MFA for production and admin surfaces → IdP config screenshots, access policy, joiner-mover-leaver procedure.
- Privileged access reviews → review logs, ticket samples, RBAC description.
- Customer data access by support → break-glass policy, audit logs.
Data protection
- Encryption at rest / in transit → cloud KMS settings, TLS policy, architecture overview.
- Backups & restore tests → backup runbooks, last restore drill notes.
- Data retention / deletion → retention schedule, DSAR / delete workflow.
Secure development
- Code review / CI checks → SDLC policy, pipeline config summary.
- Vulnerability management → scanner cadence, SLAs, recent remediation examples.
- Dependency / supply chain → SCA tooling notes, SBOM process if you have one.
Ops & incident response
- Monitoring & alerting → observability overview, on-call policy.
- Incident response → IR plan, tabletop notes, customer notification commitments.
- Business continuity → BCP / DR summary aligned to your actual RTO/RPO.
Vendors & privacy
- Subprocessors → published list + change notification process.
- DPAs / SCCs → legal pack location (don’t paste secrets into the sheet).
- Employee security training → LMS completion stats or policy + attestation.
A reusable answer workflow
- Park evidence in one vault. Policies, report excerpts, past questionnaires, and architecture notes — searchable by the people who answer forms.
- Draft from evidence, not memory. If you can’t cite a doc, mark the answer UNVERIFIED and assign an owner — don’t invent a yes to unblock a deal.
- Reuse across formats. SIG, CAIQ, and custom sheets ask the same themes. Keep canonical answers short; attach evidence IDs buyers can request.
- Refresh on a calendar. Quarterly review of high-churn answers (subprocessors, encryption details, headcount-related controls) beats annual panic.
Common failure modes
- Over-sharing: dumping the full SOC 2 PDF into a portal without redacting customer names from carve-outs.
- Stale answers: claiming MFA everywhere while a legacy admin panel still allows password-only.
- Orphan owners: “security@” answers with no named reviewer when the buyer follows up.
- AI-only drafts with no citations: confident prose that fails the first evidence request.
Where Trustfill fits
Trustfill helps you draft SOC 2–style vendor questionnaire answers from your evidence vault, with citations and UNVERIFIED flags for gaps. You approve and export — self-serve at gettrustfill.com. It does not replace your auditor, your SOC 2 report, or your accountability for what you submit.
Deeper on automation patterns: security questionnaire automation. Cost/time comparison: manual vs Trustfill.