The email lands and three words in it set your stomach off: "We need SOC 2."
Maybe it's not even that exact phrase. Maybe it's "our security team requires SOC 2 compliance," or "we can only work with SOC 2 certified vendors." However it's worded, the reaction in a lot of agency owners is the same — quiet panic. You've heard SOC 2 is a big, expensive, months-long ordeal. You've heard six figures. You're doing the math on whether the account is even worth it, and you haven't finished your coffee.
So let me tell you the thing almost nobody tells you at that moment: most of the time, your client isn't actually asking you to go get SOC 2 certified. They're asking you to prove you handle their data responsibly — and there's a much shorter road to that than the one you're panicking about.
What the client is really asking for
Strip the acronym away and here's what's underneath almost every one of these requests: before we hand you our brand's files and our customers' data, show us it's safe with you. That's the whole ask. Their security team's job is to make sure the vendors they let in aren't going to be the reason they end up in the news.
The way most enterprise clients actually check that is not by demanding a SOC 2 report. It's by sending you a vendor security review — a questionnaire. A list of questions about how you handle access, devices, files, email, the people who join and leave, and what you do when something goes wrong. You answer them, you back the answers with evidence, their team signs off, and the relationship moves forward.
Passing that review is what "prove you're safe" usually means in practice. And passing it does not require you to be SOC 2 certified. Those are two different things, and confusing them is what turns a manageable request into a false emergency.
Being SOC 2 certified vs. passing your client's review
Here's the difference, plainly.
A SOC 2 report is a formal thing. An independent, licensed auditor examines how your company handles data against a defined set of criteria, and — if you meet them — issues a report that says so. You don't award it to yourself. You can't buy it. An outside auditor has to do the examining and the signing. It's real, it's rigorous, and it's a project.
Passing a client's security review is you answering that client's questions truthfully, with proof behind each answer, so their team is satisfied. It's specific to that relationship. It's the thing on the actual deadline in your inbox.
Most of the time, the client says "SOC 2" as shorthand for "prove you're serious about security" — and what unlocks the account is a clean, well-evidenced pass on their review, not a report from an auditor. The instinct to run off and "go get SOC 2" is often solving a much bigger, more expensive problem than the one you actually have.
And if they genuinely do require it — the honest version
Sometimes the client isn't using shorthand. Sometimes their contract, their industry, or their own customers really do require a SOC 2 report from every vendor, full stop. When that's the case, you deserve the truth about what you're walking into, not a sales pitch.
Here it is: SOC 2 is not an overnight thing. Getting there typically takes somewhere between about three months and a year — and where you land in that range depends a lot on which kind of report you need. A Type 1 report is a snapshot: it looks at whether your controls are properly designed at one point in time. A Type 2 report is the heavier one: it proves your controls actually worked, consistently, across a stretch of months. Type 1 is faster to reach. Type 2 takes longer, because time is literally part of what's being tested.
So SOC 2 is a journey, not a purchase. And the worst move is to sprint down that road before anyone's even confirmed you need to be on it.
Where we come in
This is the whole reason PDRight exists — to get creative and advertising agencies through their clients' security reviews so a request never quietly costs you the account.
Practically, that starts with the question your panic skips right past: do you even need SOC 2? Most of the time the honest answer is no — what you need is to pass the review in front of you, and we get you through it. When the answer is yes, we tell you that straight, help you understand which kind of report you actually need, get your house in order so you're aligned to what an auditor will look for, and help you start that journey with your eyes open. To be clear about who does what: the report itself comes from an independent auditor, not from us. Our job is getting you ready and getting you through — so you're not guessing, and you're not paying for a year-long project you may not have needed.
If "we need SOC 2" just landed in your inbox, don't panic and don't spend a dollar yet. Send it my way and I'll give you a straight read on what your client is actually asking for — and the shortest honest path to keeping the account.