SOC 2 vendor management

A supplier sent you a SOC 2. Here is what it does not say.

SOC 2 vendor management is what happens after a supplier sends you their report: reading it properly, working out what it actually covers, and deciding what you still have to do yourself. A SOC 2 is genuinely valuable evidence — an independent auditor examined controls over a period. It is also narrower than most buyers assume, and the parts that matter most to you are the ones nobody reads: the scope, the exceptions, the subservice organizations, and the controls the report assumes you are operating.

Last reviewed 23 August 2026

What a SOC 2 report is, precisely

An auditor’s opinion on a scope the vendor chose.

A SOC 2 is an attestation report produced by an independent CPA firm under AICPA standards. It reports on a service organization’s controls relevant to one or more Trust Services Criteria: security — which is mandatory and is why the report exists — plus, optionally, availability, confidentiality, processing integrity and privacy.

Two distinctions decide how much weight it carries. Type I reports on whether controls were suitably designed at a point in time. Type II reports on whether they operated effectively across a period — typically six or twelve months — and it is the only one of the two that tells you anything about whether the controls actually run. If a vendor offers a Type I for a service that has been live for years, that is information in itself.

The critical point for a buyer: the vendor chooses the scope. Which systems, which criteria, which period. An unqualified opinion means the auditor found the controls effective within that scope — not that the company is secure, and not that the product you are buying was in it.

How to read one in twenty minutes read

Most SOC 2 reports run to a hundred pages and most reviewers read the opinion and file it. These six checks are where the information is.

Check the period, and the gap since it ended
A Type II covers a stated window. If it closed nine months ago, you have evidence about a period that ended nine months ago. Ask for a bridge letter — the vendor’s written assertion that nothing material has changed since — and note that a bridge letter is unaudited.
Check the scope covers what you are buying
Vendors with multiple products routinely certify one. Look for the specific service, the environments, and the locations. A report covering the flagship platform says nothing about the module you are procuring.
Check which criteria are in scope
Security is always there. Availability, confidentiality, processing integrity and privacy are optional — and if you are buying an uptime-critical service from a vendor who did not include availability, that is a question worth asking.
Read the exceptions, not the opinion
Section 4 lists tests performed and results, including deviations. Exceptions are normal and their presence is not damning; what matters is which controls they hit, how many, whether they recur from last year’s report, and what management said in response.
Find the subservice organizations
And whether they were carved out or included. This is the single most misread part of a SOC 2 — see below.
Extract the CUECs and assign them
The complementary user entity controls are things the report assumes you do. They are your obligations, buried in an appendix, and nobody in your organization has been told about them.

CUECs: the controls the report assumes you are running

Complementary user entity controls — the part of a SOC 2 that transfers work to you, quietly.

A CUEC is a control the service organization assumes its customers operate, without which its own controls cannot achieve the stated objectives. They appear as a list, usually late in the report, and they are stated as assumptions rather than as requests — which is exactly why they get missed.

Typical examples, and they are rarely trivial:

You provision and deprovision your own users promptly, including on termination.
You configure the security settings the platform offers — MFA, session limits, IP restrictions — rather than leaving defaults.
You review your own access logs and administrative activity.
You manage your own encryption keys where the service allows it.
You notify the vendor of security incidents and of staff changes affecting access.

Read them the right way round: the auditor’s opinion is conditional on these being true. If nobody at your end has been assigned them, the report’s conclusion does not hold for your instance — and after an incident, this is precisely where the argument about responsibility will be had.

The practical fix is unglamorous and takes an afternoon: extract the CUECs from every critical vendor’s report, give each one an owner in your organization, and re-check them at renewal. Almost nobody does this, and it is the highest-value hour in the whole SOC 2 review.

Subservice organizations, carved out and included

Where your vendor’s report stops describing your vendor.

A subservice organization is a third party your vendor relies on to deliver the service — most often a cloud platform, sometimes a data center, payment processor or managed service provider. The report handles them one of two ways, and the difference is substantial.

Under the carve-out method, the subservice organization’s controls are excluded from the scope entirely. The report describes controls at your vendor and explicitly does not opine on the provider underneath. Under the inclusive method, the subservice organization’s relevant controls are inside the examination. Carve-out is far more common.

The consequence: a carve-out SOC 2 leaves a gap exactly where your fourth-party risk lives. If a vendor carves out its hosting provider, you have an auditor’s opinion on the application layer and nothing on the infrastructure. That may be perfectly acceptable — the provider probably has its own report — but it is a gap you should close deliberately, by asking for the subservice organization’s attestation, rather than one you close by assuming.

This is also how concentration risk hides. Three critical vendors, three clean SOC 2 reports, one carved-out platform underneath all of them. Supply chain risk covers that layer.

What a SOC 2 cannot tell you cannot

Not criticism of the instrument — these are simply outside what an attestation report is built to do.

What their perimeter looks like today
The report describes a period that has ended. It cannot tell you about the service exposed last week, the certificate expiring next month, or the acquisition completed since the audit.
Whether the scope matches your risk
The vendor set the boundary. Nothing in the opinion flags what was left outside it.
How they compare with an alternative
Two unqualified opinions over two different scopes are not comparable. SOC 2 is not a score, and treating it as a pass/fail gate loses most of the information in it.
Whether they have been breached since
Incident history after the period end is outside the report by definition.
What their subcontractors are doing
Not under the carve-out method, which is the usual case.
Whether the CUECs are actually being met
The report assumes them. Only you can confirm them, and only if you read them.

Where SOC 2 fits in a vendor management program

One evidence source among several, with a specific job.

Used well, a SOC 2 replaces a large part of a security questionnaire. An auditor has already tested access management, change control, monitoring and incident response over a period — asking a vendor to re-assert all of that in a questionnaire is duplicated effort that annoys good vendors and tells you nothing new. Ask instead about what the report leaves out: the scope boundary, the carve-outs, the exceptions and their remediation, and the parts of your specific relationship no audit covers.

What it does not replace is continuous verification. The report is periodic evidence of internal control; external monitoring is continuous evidence of external posture. They answer different questions, and a program that has one and not the other has a predictable blind spot — a vendor with an excellent, current SOC 2 and an exposed management interface that appeared in month four.

A workable pattern for a critical vendor: SOC 2 Type II at onboarding and annually, CUECs extracted and owned, exceptions tracked to closure, subservice organizations identified and their attestations requested — plus continuous external monitoring between reports, with a named owner for what it surfaces. Vendor risk assessment sets out the whole process, and US financial services third-party risk covers what examiners expect on top of it.

FAQ

SOC 2 questions.

Is a SOC 2 report enough for vendor due diligence?

For a critical vendor, no — but it does a lot of the work. It gives you independently tested evidence of internal controls over a period, which replaces much of a security questionnaire. It cannot tell you about scope gaps, post-period changes, external posture today, or whether the complementary user entity controls are being met at your end.

What is the difference between SOC 2 Type I and Type II?

Type I assesses whether controls were suitably designed at a single point in time. Type II assesses whether they operated effectively across a period, usually six or twelve months. Only Type II tells you whether the controls actually run.

What is a CUEC?

A complementary user entity control — something the report assumes the customer does, without which the service organization’s controls cannot meet their objectives. They are listed in the report, they are your responsibility, and they are the most commonly missed part of a SOC 2 review.

What does it mean when a subservice organization is carved out?

That the subservice organization’s controls — often the cloud platform the vendor runs on — are excluded from the examination. The auditor opines on your vendor and not on the provider underneath, so you should request that provider’s own attestation separately.

How current does a SOC 2 need to be?

Ideally the period should have ended within the last twelve months, and you should ask for a bridge letter covering the gap between period end and today. A bridge letter is the vendor’s own unaudited assertion, so treat it accordingly.

Keep reading

The report covers last year. We cover this morning.

Book a 30-minute call, name a vendor with a clean SOC 2, and we will show you what their external posture looks like right now — the part no attestation period includes.

Book a 30-min demo →See vendor risk management