The questionnaire
Sort a 60-question security questionnaire into the 20 you answer on the call and the 40 you route, and answer yours in the SOC 2 criteria's own words.
On this page
The security questionnaire arrives in week 3 with 60 questions, and behind it sits a review that takes the customer's security team two to six weeks and stands between a passing pilot and a signature. About 20 of the questions are about the deployment you built: you answer them on the call, with evidence, in the words the customer's auditor uses. The other 40 are about your company, and the most expensive sentence of the pilot is an improvised answer to one of them.
The answer that restarted the review
In week 3 of the worked pilot, the security lead reaches question 41 on the call: will the vendor notify them of a breach within 24 hours? The engineer, wanting the call to go well, says yes, and it goes into her minutes. Two weeks later the written answers arrive, matching the vendor's data processing agreement: notification "without undue delay". Procurement now holds two answers to one question, and the review goes back to the start of the queue. Started in week 3, a six-week review ends in week 9; restarted in week 5, it ends in week 11, the week the budget closes. The engineer answered a question that was not theirs, and the fix is to sort the questionnaire before the call.
Two piles, sorted before the call
A question about this deployment (what it reads, where the data goes, how long it stays, who can reach it, how a change ships) is yours. A question about the company (attestations, policies, people, contracts, incident response) belongs to your security team, even when you know the answer: it becomes a representation in the contract and must match what the auditor tested.
| Area | Questions | Yours, on the call | Security team, in writing |
|---|---|---|---|
| Data flow and residency | 10 | 7 | 3 |
| Access and least privilege | 8 | 5 | 3 |
| Retention and deletion | 6 | 4 | 2 |
| Model behaviour: training, injection, output | 6 | 4 | 2 |
| Attestations: SOC 2, ISO 27001, penetration test | 8 | 0 | 8 |
| Subprocessors and the processing agreement | 6 | 0 | 6 |
| Incident response and breach notification | 6 | 0 | 6 |
| Company controls: staff, continuity, insurance | 10 | 0 | 10 |
| Total | 60 | 20 | 40 |
Split rows take judgement: "Is data encrypted at rest?" is yours for the prompt log in the customer's tenant and the security team's for your company's own systems; answer your half and route the other in the same breath.
For every routed question, one sentence, said the same way each time: "That is a question about our company's controls rather than this deployment, so our security team answers it in writing, to match our audit report. I have noted it in your words, and you will have it by Monday." It says whose question it is, why the answer is written, and when it arrives.
SOC 2 in the criteria's words
SOC 2 is an attestation, not a certificate: an auditor's report on a company's controls against the AICPA's Trust Services Criteria. Of the five categories (security, availability, processing integrity, confidentiality, privacy), security, the common criteria, is in every report. A Type I report says the controls were suitably designed on one date; a Type II says they operated across a period, usually six to twelve months, and lists the exceptions found in the auditor's samples. Customers ask for Type II.
Read three parts of your company's report before the call: the system description (does it include the product being deployed?), the exceptions, and the complementary user entity controls, which the report assumes the customer runs, such as disabling a principal when the pilot ends, the off switch from auth and the boundary. If the period ended months ago, ask your security team for a bridge letter. Read an ISO 27001 certificate's scope the same way: "corporate IT and the hosting platform" says nothing about a service in the customer's tenant.
Your 20 answers map onto the criteria, and their words tell the security lead which control each answer evidences:
- Access (CC6.3), granted "giving consideration to the concepts of least privilege and segregation of duties". The grant list: one service principal, four views with a row filter, three tables written, one named engineer account expiring at pilot end plus 14 days, revocation tested in 60 seconds.
- Movement of data (CC6.7), restricting "the transmission, movement, and removal of information". One outbound path over TLS, carrying the redacted loss description and the policy wording, with the redaction's 3% miss rate on a 200-description sample stated.
- Change (CC8.1). A prompt change is a change: every version runs the 200-case eval before it ships, and the run is kept.
- Disposal (C1.2, in reports that include the confidentiality category). The prompt log is deleted at 30 days by a scheduled job whose last run you can name.
"We take access seriously" is a claim; "here is the grant list and the revocation test from the first live day" is evidence that a control operated, which is what an auditor checks and what the security lead can file.
Residency, retention, subprocessors
Each hides two answers, and only you know which half applies to this deployment.
Residency asks where data is stored and where it is processed. Storage, for the worked pilot, is the customer's tenant. Processing includes the model call, which with a hosted API happens in the provider's region: answer from the contract or the provider's published terms, with the clause, never from memory. Where the model sits sets out what each placement does to this answer.
Retention has three locations: the tenant, where you set it (30 days for the prompt log); the provider, whose terms you cite by clause; and your own company, where it should be nothing. A debug log holding a copy is a finding to fix before the call.
Subprocessors depends on whose contract the model call runs under. On an API key from your company's account, the provider is your subprocessor: it is on the list in your data processing agreement, and under GDPR Article 28 the customer may object to a new one once told. Through a model listing in the customer's own cloud tenant, under their agreement, it is their processor, not yours. You say which is true; the list and the agreement are the security team's.
The call
Send the data-boundary page in week 2, as what the deal depends on argues, so the review starts before the questionnaire does. Bring four documents: the drawing, the grant list, the retention settings with the deletion job's last run, and the eval log by prompt version. Answer each of your 20 by pointing at one of them; say the sentence for each of the 40 and log it.
The same afternoon, the routed list goes to your security team with the drawing and the date you gave, which is now yours to keep. Started in week 2 on the boundary page, even a six-week review ends in week 8; started on the questionnaire in week 3, it ends in week 9, still two weeks before the budget closes. Every improvised answer that has to be withdrawn restarts the clock.
In an interview
The customer-scenario round often includes a security question, testing whether you know which questions are yours, whether your answers cite evidence rather than intentions, and whether you can route a question without sounding evasive. Answer a deployment question with the artefact ("one principal, four views, revocation tested in 60 seconds"); route a company question with the sentence, an owner and a date. In the role, the customer's security lead notices whether your answers can be filed as they stand.
The mistake that loses points is improvising a company-level commitment (a breach-notification time, a retention promise, "yes, we're SOC 2" when the report does not cover the product) because it sounds helpful, and it becomes a contractual representation nobody approved. Close behind: "no personal data leaves your tenant", said about a redaction pass that misses 3% of mentions.
Check yourself
1. The questionnaire arrives in week 6 instead of week 3, the review takes up to six weeks, and the budget closes in week 11. Does the contract make the budget, and what do you change?
Not at the worst case: week 6 plus six weeks is week 12. Answer your 20 in writing within two days, ask your security team for the 40 in five working days, and ask the security lead which questions block approval so those are reviewed first. Send the data-boundary page today; it should have gone in week 2.
2. Your SOC 2 Type II period ended seven months ago, and the system description names the platform but not the pilot tooling in customer tenants. The security lead asks, "Are you SOC 2?" What do you say?
Not a bare "yes". The company has a Type II report; the security team will send it under NDA with a bridge letter for the seven months; and the deployment's own controls are on the data-boundary page she already has, because the report does not cover them. Then report the scope gap internally.
Source: AICPA, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (revised points of focus, 2022); ISO/IEC 27001:2022; Regulation (EU) 2016/679 (GDPR), Article 28.