Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

How do we…

How do we read a supplier's SOC 2 report?

8 decision pointsThe pack behind this answer: SOC 2 Report Readiness

Add to board memo

The short answer

Recommendation
Check the report is a Type 2 report on the service, categories and legal entity you rely on, with a period that ended within the last 12 months. Read the opinion, every exception and the controls it expects you to operate, record each gap as a finding, and let the business owner decide.
Reasoning
A SOC 2 report is the supplier's CPA firm's opinion on one system for one period. It says nothing about another product, another period or the operation of a Type 1 report's controls over time. Its exceptions, its carved-out providers and the controls it assumes of you are the parts that change your own risk. You do not re-grade the opinion. You decide what those parts mean for you.
Considerations
  • A report on another product of the supplier, or a Type 1 report, does not show how the service you buy operates over time.
  • A bridge letter is the supplier's management speaking. The CPA firm gives no assurance over it.
  • The supplier's tier sets how much assurance you ask for and how often you reassess.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartA supplier has sent us its SOC 2 reportDecisionDoes it cover our service and categories, for the right entity?DecisionIs it a Type 2 report?DecisionDid the report period end within the last 12 months?DecisionDid the period end more than 3 months ago?StepAsk for a bridge letter and the date of the next reportStepRead the opinion, every exception and the supplier's responseDecisionIs the opinion qualified, or is an exception on a control we rely on?StepRecord a finding for the opinion or the exceptionStepNote which of its own providers the report carves outStepList the controls the report expects customers to operateDecisionDo we operate each of those controls today?StepRecord the gap and add the control to your own planDecisionHas any check raised a finding?DecisionIs the residual risk outside the appetite for supplier risk?OutcomeAsk for a report that fits, or other independent assuranceOutcomeAccept the report and set the next reassessmentOutcomeApprove with conditions: findings, owners and deadlinesOutcomeTake the risk to its owner for a treatment decision

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one. A code beside a source, such as RR-17, is the number of a rule in that pack document; the document lists its rules.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 19 steps.

  1. Start

    A supplier has sent us its SOC 2 report

    The supplier's tier decides whether you ask for an independent report at all. Tier 1 asks for independent assurance, Tier 2 for a certification, an independent report or key policies with evidence they operate, Tier 3 for a self-declaration with evidence sampled, and Tier 4 for nothing beyond intake. Receiving a report is not the same as the evidence counting. It counts once its scope, dates and name are validated.

    In the pack

  2. Decision

    Does it cover our service and categories, for the right entity?

    A report on another product of the supplier is not a report on yours. Check that its system matches the service you buy, that its categories include what you rely on, and that it is in the name of the company you contract with. Security is in every SOC 2 report. The other categories are there only if the supplier chose them.

    In the pack

  3. Decision

    Is it a Type 2 report?

    A Type 1 report covers the description and the design of the controls as of one date. It says nothing about operation over time. A Type 2 report adds an opinion on operating effectiveness throughout a period, with the auditor's tests and results.

    In the pack

  4. Decision

    Did the report period end within the last 12 months?

    Evidence must be in date. The pack's default is that the report period and its tests fall within 12 months, and a gap of more than 12 months means treating the report as out of date. Your own standard may set another figure.

    In the pack

  5. Decision

    Did the period end more than 3 months ago?

    The pack's default asks for a bridge letter when the report period ended more than 3 months before the review. Your own standard may set another figure. The pack's SOC 2 guidance treats about 3 months as the usual limit for a letter, so past that point ask for the date of the next report as well.

    In the pack

  6. Step

    Ask for a bridge letter and the date of the next report

    A bridge letter is signed by a named manager of the supplier's contracting entity and says whether the controls changed or failed between the period end and today. It is management's statement. The CPA firm gives no assurance over it, so follow up any change it declares and set a reminder for the next report.

    In the pack

  7. Step

    Read the opinion, every exception and the supplier's response

    Read the CPA firm's opinion, then every exception listed in the tests and results and what the supplier's management said about it. The firm decides how an exception is reported. You decide what it means for you. An exception on a control you assume of the supplier is a risk to you.

    In the pack

  8. Decision

    Is the opinion qualified, or is an exception on a control we rely on?

    The pack lists a qualified opinion, and exceptions in access control or change management, among the red flags for an independent report. Weigh any exception against what the supplier does for you: the data it holds, the access it has, the service you depend on. If you cannot tell, take the cautious answer.

    In the pack

  9. Step

    Record a finding for the opinion or the exception

    Write what is missing, how severe it is and the deadline to fix it, counted from the date the review report is issued to the supplier. The pack's severities are High, Medium and Low with 90, 180 calendar days and tracking to the next assessment as defaults. Agree each finding with the supplier.

    In the pack

  10. Step

    Note which of its own providers the report carves out

    Their controls are two steps from you, and the supplier's report is the only place that says so. Ask how the supplier assesses those providers, and check that its evidence covers the part they deliver.

    In the pack

  11. Step

    List the controls the report expects customers to operate

    The report names the controls the supplier assumes its customers operate so that its own controls work as described. Those are duties of yours. Add each to your own controls, or explain why it does not apply.

    In the pack

  12. Decision

    Do we operate each of those controls today?

    A control you assume the customer operates is only as good as the customer's operation of it. Check each against what your own teams do: who removes your leavers, who protects your administrator credentials, who reviews your approvers. If you cannot show it, the answer is No.

    In the pack

  13. Step

    Record the gap and add the control to your own plan

    A customer duty you do not meet is a finding on your side as well as the supplier's report. Give it an owner and a date, and put the control into your own control set so that the supplier's controls can work as described.

    In the pack

  14. Decision

    Has any check raised a finding?

    If every check was clear, the report can be accepted as it is. If any raised a finding, the residual risk must be rated against your appetite for third-party risk before anyone signs.

    In the pack

  15. Decision

    Is the residual risk outside the appetite for supplier risk?

    Rate the residual risk the supplier leaves with its validated controls and your own around it, and compare it with your appetite for third-party risk. The business owner decides on the assessor's report: approve, approve with conditions, escalate or reject. While a High finding is open the decision cannot be a plain approval.

    In the pack

  16. Outcome

    Ask for a report that fits, or other independent assurance

    Evidence that fails a check counts as not received. Ask the supplier for a report on your service, a Type 2 report, or one in date. The pack's tier rules also accept a certification with a matching scope as the tier's assurance, which is a different document about a different subject. If none exists for a Tier 1 supplier, propose a finding and consider escalating.

    In the pack

  17. Outcome

    Accept the report and set the next reassessment

    Record the checks on the evidence checklist and the signed decision, and keep the report as the supplier's, shown to others only as its terms allow. Set the reassessment at the interval the tier sets, and start it before it is due. Reassess early on a material change or an incident at the supplier.

    In the pack

  18. Outcome

    Approve with conditions: findings, owners and deadlines

    The business owner approves with conditions when the residual risk is within appetite and named findings are fixed by their deadlines. Put the conditions in the contract or the register. Track the findings to their deadlines and tell the business owner in writing when a High one passes its deadline.

    In the pack

  19. Outcome

    Take the risk to its owner for a treatment decision

    A residual risk outside appetite goes to the information security risk register, and its owner decides the treatment within the pack's default of 30 calendar days. Only then does the purchase go ahead or stop.

    In the pack

    See also

Practical checklist

  1. Name the report: type, categories, system, period, issuer and the legal entity.
  2. Check the period ended within the last 12 months. If it ended more than about 3 months ago, ask for the date of the supplier's next report; a bridge letter on its own no longer closes that gap (P32-A10).
  3. Read the opinion, every exception and the supplier's management response.
  4. List the controls the report expects you to operate and check that you operate them.
  5. Note which of the supplier's own providers the report carves out.
  6. Record each gap as a finding with a severity and a deadline.

Evidence to have ready

  • The report as received, with its period and the date you received it.
  • The completed evidence checklist: scope, dates, entity, and opinion and exceptions read.
  • The findings, their owners and deadlines, and the signed decision.
  • The supplier's bridge letter, if one was needed.

Assumptions

  • The supplier has a tier from your supplier assessment, and its SOC 2 report is the evidence you are reading for that tier.
  • You hold the report under the supplier's terms of use. A SOC 2 report is generally restricted in use, so check who may receive it.
  • The 12 months, the 3 months and the severities and deadlines are the supplier process's defaults. Your own standard may set different ones.

Not covered here