Tidal Control incident
When customers ask for SOC 2 and what they really mean
Resolved on March 4, 2026.
When customers ask for a SOC 2 report, they are usually asking for evidence they can share internally to prove due diligence, not for the report itself. ISO 27001 certification or a detailed security questionnaire is often an acceptable substitute. Waiting until a customer asks is the most common mistake: setting up controls that map to both SOC 2 and ISO 27001 from the start means a report can be reached in three to six months once the request arrives, rather than nine to fifteen months from scratch.
Update timeline
- resolved Mar 04, 2026, 12:00 AM UTC
When customers ask for a SOC 2 report, they are usually asking for evidence they can share internally to prove due diligence, not for the report itself. ISO 27001 certification or a detailed security questionnaire is often an acceptable substitute. Waiting until a customer asks is the most common mistake: setting up controls that map to both SOC 2 and ISO 27001 from the start means a report can be reached in three to six months once the request arrives, rather than nine to fifteen months from scratch.
Your product runs on more than Tidal Control
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services