Compliance
Responding to an Enterprise Customer's Security Requirements
Answer each request in an enterprise customer's security questionnaire, contract schedule or vendor assessment with the evidence that actually covers it: a SOC 2 report issued by a licensed CPA firm, an ISO/IEC 27001 certificate from an accredited certification body whose scope includes the service being bought, a penetration test report or attestation letter for the systems in question, or your own approved policies. Where you do not have something yet, say so and give a dated plan; an honest 'not yet, by this date' survives procurement, and an overclaim found later does not. SecureRoot runs the testing and the SOC 2 and ISO/IEC 27001 readiness work behind those answers. It does not issue SOC 2 reports or ISO certificates.
About this guide
Written by SecureRoot Risk Advisory LLP.
The request
What an enterprise buyer actually sends
Security requirements usually arrive in one of three forms, often all three in one procurement. They ask overlapping questions, but they are different kinds of document and carry different weight.
- A security questionnaire. Either the buyer's own spreadsheet or a standard one. The Cloud Security Alliance's Consensus Assessments Initiative Questionnaire (CAIQ) is a common standard example: a set of yes or no questions for assessing cloud providers, built on the CSA Cloud Controls Matrix. A questionnaire records what you say about yourself.
- A contract security schedule. Clauses you will be bound by once you sign: security obligations, a deadline for notifying the customer of an incident, audit or evidence rights, where data may be stored, approval of subcontractors, and return or deletion of data when the contract ends. These are promises, not descriptions.
- A vendor assessment. The buyer's third-party risk team asks for evidence rather than answers: a SOC 2 report, an ISO/IEC 27001 certificate with its scope, a recent penetration test summary, named policies, and sometimes a call with your security lead.
Read all three before answering any of them. A questionnaire answer that says 'we notify customers of incidents promptly' is weaker than, and can contradict, a schedule clause that says 'within 24 hours'. Your legal and security owners need to see the same text.
Evidence
Which document answers which request
Most requests are answered by one of five things. Each answers some questions well and others not at all, and buyers' reviewers know the difference.
- 'Send us your SOC 2 report.' Only a SOC 2 report answers this. SOC reports are assurance reports CPAs provide under professional standards the AICPA sets, and a SOC 2 examination reports on controls against the Trust Services Criteria for security and, where selected, availability, processing integrity, confidentiality or privacy. A Type 1 and a Type 2 answer different questions; see the SOC 2 Type 1 vs Type 2 guide.
- 'Are you ISO 27001 certified?' Only a certificate from an accredited certification body answers this, and only if its scope covers the product, sites and teams the customer is buying from. A certificate for a different entity, or a scope that excludes the service, is the first thing an experienced reviewer checks.
- 'Provide your latest penetration test.' A test report for the systems the customer will use answers this, ideally with a retest report showing which findings were fixed and verified. Where the request asks for an attestation letter or a summary rather than the full findings report, send that and keep the full report for an NDA. A test of your marketing site does not answer a question about your product.
- 'Provide your information security policies.' Your approved policies answer this: information security, access control, change management, incident response, vendor management, business continuity and similar. A policy shows intent. It does not show the control operates, which is why buyers who can get a SOC 2 report or an ISO certificate prefer it.
- 'We need a QSA-signed ROC', 'a CERT-In empanelled auditor' or similar named signatures. Only the named type of signatory can provide these. The guide to who can sign your security report sets out which body qualifies each one.
| The request | What answers it | Who issues or signs it | What does not answer it |
|---|---|---|---|
| 'Send us your SOC 2 report.' | A SOC 2 report, Type 1 or Type 2; the two answer different questions | A licensed CPA firm | Anything that is not a SOC 2 report, including a penetration test letter |
| 'Are you ISO 27001 certified?' | An ISO/IEC 27001 certificate whose scope covers the product, sites and teams the customer is buying from | An accredited certification body | A certificate for a different entity, or a scope that excludes the service |
| 'Provide your latest penetration test.' | A test report for the systems the customer will use, ideally with a retest report; an attestation letter or summary where that is what is asked | The firm that ran the test | A test of your marketing site, when the question is about your product |
| 'Provide your information security policies.' | Your approved policies | Your organisation | Proof that a control operates: a policy shows intent only |
| 'A QSA-signed ROC', 'a CERT-In empanelled auditor' or another named signature | The document from that named type of signatory | Only the named type of signatory | A report or letter from anyone else |
| A CSA STAR registry entry | Level 1: a CAIQ submitted and published on the STAR registry. Level 2: a third-party ISO/IEC 27001 certification, SOC 2 attestation or C-STAR assessment combined with a CAIQ | Level 1: you, as a self-assessment. Level 2: the third party | A completed CAIQ on its own is not a certification |
Some buyers also accept or ask for a CSA STAR registry entry. STAR Level 1 is a self-assessment in which a CAIQ is submitted and published on the STAR registry; Level 2 combines a third-party ISO/IEC 27001 certification, SOC 2 attestation or C-STAR assessment with a CAIQ. If you already maintain a CAIQ, it can be reused across questionnaires.
Answering
How to answer without overclaiming
Answers given in procurement are often attached to the contract or relied on in it. The goal is a response that is still true when the customer's auditor, or your own, reads it a year later.
- 01
Classify every question before writing
Mark each one as in place, in progress with a date, not applicable with a reason, or not in place. Questions answered 'yes' by default because the honest answer is awkward are the usual source of trouble.
- 02
Answer for the scope the customer is buying
If your certificate or report covers one product and the customer is buying another, say so. If a control is run by your cloud provider rather than by you, say that, and point to the provider's own assurance material instead of answering as if the control were yours.
- 03
Use the exact name of what you hold
A readiness assessment is not a certification. A SOC 2 Type 1 is not a Type 2. A penetration test is not an audit. A policy that is approved but not yet followed is in progress. Precision here costs nothing; imprecision is what a reviewer flags.
- 04
Attach evidence, not adjectives
Where a question asks whether something happens, attach or offer the record that shows it: an access review, a test report, an incident procedure. 'Industry-standard', 'bank-grade' and 'fully compliant' answer nothing.
- 05
Send sensitive documents under a non-disclosure agreement
A SOC 2 report and a penetration test report describe how your controls work and where they were weak. Share them under an NDA with the buyer, and offer a summary or attestation letter before the full findings report.
- 06
Keep an answer library
Store each approved answer with its owner, its evidence and the date it was last checked. The next questionnaire then takes days, not weeks, and answers stay consistent across customers.
A deal is waiting
What to do first when a deal is waiting
- 01
Ask the customer what they will accept, and by when
Ask the buyer's security reviewer directly. Some will accept a current penetration test, your policies and a dated plan for SOC 2 or ISO/IEC 27001; others make a report or certificate a condition of signature. You cannot plan until you know which.
- 02
Return the questionnaire honestly now
A prompt, accurate response with gaps marked and dated keeps the deal moving. A late or inflated one does not.
- 03
Commission a penetration test of the product the customer will use
It is usually the fastest independent evidence you can add. SecureRoot's published timeline for testing is one to three weeks per web application, mobile application, API or network, then a retest window once your fixes are in. The deliverables include a findings report, an executive summary, a verified retest report and an attestation letter.
- 04
Start the programme the customer named
SecureRoot's published timelines: a SOC 2 Type 1 takes eight to twelve weeks; a first Type 2 takes six to nine months, assuming a three-month observation window; ISO/IEC 27001 takes four to seven months to a first certificate. The CPA firm's or certification body's own work sits within or after those dates and is contracted by you. If the customer, or the next one, will want both, plan them together.
- 05
Put the plan in writing, and keep to it
Send the customer the dated milestones you can commit to: the test date, the readiness start, the audit window. Update them if anything moves. A buyer can usually work with a plan; it cannot work with silence.
SecureRoot's part
Where SecureRoot fits
SecureRoot provides the testing and readiness work that produces the evidence: manual penetration testing with a verified retest and an attestation letter, and SOC 2 and ISO/IEC 27001 readiness, run separately or as one programme from one control set. The attestation letter states what was tested, when, by whom and to what method. It is not a substitute for a SOC 2 report, an ISO certificate or any other signature a customer names.
What goes into your questionnaire and your contract is yours to answer and sign. SecureRoot is not a CPA firm, an accredited certification body or a QSA, and is not CERT-In empanelled. Where a customer names one of those, the qualified party signs, and SecureRoot says so on the scoping call.
Scope boundaries
What this does not cover
- SecureRoot does not issue SOC 2 reports (a licensed CPA firm does) or ISO/IEC 27001 certificates (an accredited certification body does), and signs no ROC or AOC.
- SecureRoot does not complete or sign questionnaires, contracts or customer attestations on your behalf; the answers and the commitments are yours.
- This guide is not legal advice. Have your legal adviser review contract security schedules before you sign.
- No test, readiness programme or answer strategy guarantees that a customer will accept your evidence or sign the deal.
- Fees for the CPA firm, certification body or QSA are outside SecureRoot's quote and are paid to them directly.
Questions
Common questions
Can a penetration test letter replace a SOC 2 report?
No. A penetration test shows what a tester found and whether fixes were verified on the systems tested. A SOC 2 report is an examination of controls by a licensed CPA firm. Some buyers accept a test letter plus a dated plan while a report is in progress; that is the buyer's decision, so ask.
We have no certificate or report yet. Should we leave those questions blank?
No. Answer them as 'not in place' or 'in progress' with the date you expect it, and offer what you do have, such as policies or a recent test. A blank looks like an oversight; a dated answer looks like a plan.
Is a completed CAIQ a certification?
No. The CAIQ is a questionnaire you complete about your own cloud service. Published on the CSA STAR registry it is a Level 1 self-assessment; STAR Level 2 adds a third-party certification or attestation.
Primary Sources
Where the Figures on This Page Come From
Figures and requirements above are taken from the sources below, linked to the primary text wherever one exists rather than to a summary of it.
- System and Organization Controls: SOC Suite of Services
AICPA and CIMA · Link checked 2026-11-13
- 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (with revised points of focus, 2022)
AICPA and CIMA · Link checked 2026-11-13
- CSA STAR Program: Level 1 self-assessment and Level 2 third-party audit
Cloud Security Alliance · Link checked 2026-11-13
- Cloud Controls Matrix (CCM) and the Consensus Assessments Initiative Questionnaire (CAIQ)
Cloud Security Alliance · Link checked 2026-11-13
Related
Services and help that go with this
- Who can sign your security report
Which body qualifies a CPA firm, certification body, QSA or empanelled auditor.
- SOC 2 Type 1 vs Type 2
What each report tests, and which a waiting customer is likely to want.
- Planning a combined SOC 2 and ISO 27001 programme
One control set and one evidence library for both assessments.
- Choosing a framework or report
A short decision aid by who is asking.
- SOC 2 readiness and audit support
Criteria selection to fieldwork, Type 1 or Type 2.
- ISO 27001 certification services
Gap assessment through Stage 1, Stage 2 and surveillance.
- Web application penetration testing
Manual testing with a verified retest and an attestation letter.
- Pricing
Published bands, timelines and the fees outside them.
A customer is waiting on your evidence
Send SecureRoot the questionnaire, schedule or request and the date the customer needs an answer by. We will tell you which parts testing or readiness can evidence, what that takes, and which parts need a CPA firm, certification body or other signatory.