PW-SOC2-012
CAIQ-Lite and SIG-Lite questionnaires while SOC 2 is in progress
Using CAIQ-Lite / SIG-Lite security questionnaires to keep deals moving before a SOC 2 report exists.
PW-SOC2-005 SOC 2 readiness spoke · Answer buyers · 6/7
What to send procurement in week 2 (SOC 2 in progress)
TL;DR. When you cannot yet attach a SOC 2 report, send a clear in-progress status, security overview, architecture diagram, MFA/encryption statements, subprocessors list, and a filled CAIQ-Lite or SIG-Lite. Honesty about timeline beats a vague “coming soon.”
Key terms: CAIQ Lite, SIG Lite.
Educational packet checklist — completing squares does not mean you are audit-ready. No localStorage.
PACKET · EMPTY
No buyer questionnaire yet — use this packet when one arrives. Keep answers versioned and honest about SOC 2 status.
On this page
Week-2 packet contents
- Status letter — scoped categories, Type 1/2 intent, target report month, auditor engaged or shortlisted.
- One-page security overview — hosting, encryption in transit/at rest, MFA, logging, incident contact.
- Architecture diagram — data flow at a level you would show a SE.
- Subprocessors list — current, dated.
- Questionnaire — CAIQ-Lite or SIG-Lite completed from a single source of truth.
- Policies index — titles + last reviewed dates (attach only if asked).
What not to invent
- Do not imply a report date you cannot hit.
- Do not claim certifications you do not hold.
- Do not give conflicting answers across two buyer portals—version your pack.
A real questionnaire is often the right trigger to start SOC 2 in earnest—not a vague “we should get compliant someday.”
Print packet squares
Check off packet contents when printing. Progress is not stored.
- Status letter (scope + timeline)
- One-page security overview
- Architecture diagram
- Subprocessors list
- CAIQ-Lite or SIG-Lite
- Policies index
Questions founders ask
What if they demand a report this month?
Share status, packet, and the soonest honest date—or walk if the date is impossible.
Should we share draft policies?
Prefer an index; share full policies when requested under NDA.
Is a pen test required in week 2?
Not universally. Send what you have; do not invent.
Sources
Cost and timeline figures on this site are educational planning ranges, not quotes from AICPA, CSA, Shared Assessments, or any auditor.
- primary What is CAIQ? — Cloud Security Alliance — CAIQ explained as CCM-aligned yes/no questionnaire.
- primary Shared Assessments (SIG) — Shared Assessments — Org home for Standardized Information Gathering (SIG). Detailed SIG Lite templates are often member-gated—cite org, do not invent free PDF links.
- practitioner ProofWindow educational planning ranges — ProofWindow Editorial — Internal: cost/timeline bands are editorial planning language, not a surveyed dataset. Label Unknown for hard dollars; never attribute invented figures to AICPA/CSA/SA.
Linear path
← Path: SOC 2 auditor engagement letter before the report
Next in path: Starting SOC 2 Type 2 after Type 1 (observation window handoff) →