Responding to a SOC 2 RFP
Most SOC 2 proposals lose before anyone reads the methodology section, and they lose for one of two reasons: the firm answered a question the buyer did not ask, or it quoted a number the buyer could not compare with anything.
Decline about a third of them. A SOC 2 request for proposal that names no budget, no date, no Trust Services categories and no incumbent is usually a buyer collecting three quotes to justify a decision already made, or a first-time buyer who does not yet know what they are buying. The second is worth a phone call. The first is worth a polite pass, and firms that pass on it win more work per hour spent than firms that answer everything.
The rest of this page is about the responses worth writing.
Qualify before you write
- Ask who is asking for the report and what they wrote. If nobody named SOC 2 in a contract, the project may not happen and you are pricing a hypothetical.
- Ask whether the categories beyond Security are settled and who named them. Scope that moves after award is how a fixed fee becomes a loss.
- Ask for the date and who set it. A date set by a customer is real. A date set internally moves.
- Ask who else is bidding and whether an incumbent is involved. Most buyers answer honestly, and the answer changes whether you bid.
- Ask whether they have an audit firm engaged. A buyer with a signed engagement letter is a real project with a fixed window.
- Ask what budget was approved. Half say, and the half that do save you a day.
A request for proposal that will not take a call
Some procurement processes forbid contact during the window, which is normal in public sector. For a private company, refusing a fifteen minute scoping call while asking for a fixed price tells you how the engagement will run. Decline, and say why. That is remembered better than silence.
What buyers actually score
Scoring sheets vary and the weight lands in the same six places every time. None of them is your methodology diagram.
| What the buyer is assessing | How they assess it | Common failure |
|---|---|---|
| Did you understand our scope | Whether your proposal restates their environment accurately | A generic scope paragraph that could describe anyone |
| Is the price comparable | Whether they can line your number up against two others | A single number with no breakdown, or an all-in figure bundling things the others excluded |
| Who is actually doing the work | Named people with named experience | Firm credentials with no individuals attached |
| Will the date hold | A schedule with dependencies on them made explicit | A timeline that assumes the client responds instantly |
| What is not included | An explicit exclusions list | Silence, which the buyer reads as included and you read as extra |
| Have you done this shape of company | One relevant example described specifically | A logo wall |
Present the price so it can be compared
The most common reason a good proposal loses is that the buyer could not compare it. They hold three documents: one all-in figure, one set of phases, one day rate and an estimate. They pick the one they understand. Make yours that one.
Break the fee into gap assessment, remediation support, evidence and audit liaison, and any retained work after the report. Show what each phase includes and what it assumes of them. Then give a total. If the buyer's budget is wrong because they are comparing readiness against the examination fee, say so and point at the four lines of a first-year SOC 2 budget. Almost nobody corrects a buyer's mental model in a proposal, and for a first-time buyer it is the most useful thing in the document.
The exclusions section is the one that protects you
State plainly what is not in the fee. The usual list is remediation engineering in the client's codebase, penetration testing, the audit firm's own fee, compliance platform licences, a second round of policy revisions beyond a stated number, and support for Trust Services categories added after award. A buyer has assumed every one of those was included at some point, and the assumption surfaces at the worst moment.
Firms worry that an exclusions list looks defensive. Buyers who have run one of these projects read it as the only honest document in the pile, and the ones who have not read it as an explanation of something they did not understand. Where readiness engagements lose money is this list from the other side.
Say the independence thing before they ask
If you are a readiness firm, state that you do not issue the report, name why not, and say that a separate CPA firm will perform the examination. If you are a CPA firm, state that you cannot perform the readiness work for a client you will audit. The buyer finds both out eventually, and finding them in your proposal builds more credibility than any credential. The split between the two sides is worth a paragraph in every proposal you send.
Why proposals lose when the price was right
- Length
- Forty pages for a $30,000 CAD engagement signals that the firm reuses a template. A tight ten page document that answers their questions in their order wins against it consistently.
- Answering a different question
- A buyer asking how you will get them audit-ready by March does not want your assessment methodology. Answer in their order, with their words.
- No named individuals
- Buyers are hiring people. A proposal with no names in it is asking them to trust an entity, which is a harder thing to do.
- Unqualified certainty
- Promising a clean opinion, or a date that does not depend on the client, reads as either naive or dishonest to anyone who has done this before.
- No position
- Every firm says it is thorough and pragmatic. A proposal that says the buyer should not include Privacy, or should not buy a platform at their size, is the one that gets discussed after the call.
After you send it
Ask for a debrief whether you win or lose, and ask one specific question: what would we have had to change to win this. Buyers answer specific questions and ignore general ones. A losing proposal with a real reason attached is worth more than a win you cannot explain. The reason is usually structural and it will decide the next five.
Claim a listing
Buyers who arrive through a directory have usually already accepted your order of magnitude, which makes for a shorter proposal.
List your firmShould I respond to every SOC 2 RFP?
No. Decline the ones with no named budget, no date, no settled Trust Services categories and no willingness to take a scoping call. Those are usually a buyer collecting quotes to justify a decision already made. Firms that pass on a third of requests win more work per hour spent.
What do buyers score in a SOC 2 proposal?
Whether you restated their scope accurately, whether the price can be compared with the other two bids, who specifically will do the work, whether the schedule names what it needs from them, what is excluded, and one relevant example described in detail. Methodology sections carry less weight than firms assume.
How should I break down the price in a proposal?
By phase: gap assessment, remediation support, evidence and audit liaison, and retained work after the report, with a total at the end. Buyers hold three documents and pick the one they can line up against the others. A single all-in number is the hardest to compare and loses most often.
Should a proposal include an exclusions list?
Yes. Name remediation engineering, penetration testing, the audit firm's fee, platform licences, extra policy revision rounds and categories added after award. Experienced buyers read it as the most honest document in the pile, and it is the section that prevents the argument in month three.
How long should a SOC 2 proposal be?
Around ten pages for a typical readiness engagement. Forty pages for a $30,000 CAD piece of work signals a reused template, and buyers read it that way. Answer their questions in their order and in their words, then stop.