Which service providers do we carve out of our SOC 2 report, and what do we tell customers?

Start

Other companies run parts of the service we put in the report

A provider that runs part of the system is a subservice organisation when its controls matter to the commitments. For each one you choose the carve-out or the inclusive method, or place it outside the boundary, before the description is written. Management chooses. The CPA firm advises and decides what it can examine.

• Then: List every provider that runs part of the service

Step

List every provider that runs part of the service

Take the providers from your supplier register. The pack's worked example lists a hosting provider, an email delivery provider and a payment processor. For each, note what it does for the service, whether customer data or production access goes through it, and whether it gives you its own SOC 2 report.

• Then: Does it run part of the system and affect the commitments?

Decision

Does it run part of the system and affect the commitments?

A provider is outside the boundary when no customer data or production access goes through it, or it does not affect the commitments. If you cannot say which, treat it as a provider that matters.

• Yes, or not known: Do you hold the provider's latest SOC 2 report?
• No: Place it outside the boundary, with the reason

Step

Place it outside the boundary, with the reason

Write a line in the boundary section with the reason, and check each period that the reason still holds. In the pack's worked example the payment processor is outside because customers' invoice data does not flow through it. No controls are assumed of a provider that is outside.

• Then: Is another provider left to decide?

Decision

Do you hold the provider's latest SOC 2 report?

A carve-out depends on the provider's own controls, so the pack recommends holding the provider's latest report first. If a provider has no report, or only an older one, ask it for its current report or equivalent assurance before you rely on a carve-out. Decide before the period starts, because the choice is stable for a period.

• Yes: Read the report on five points and write down what you find
• No, or only an older one: Ask the provider for its current report or equivalent assurance

Step

Ask the provider for its current report or equivalent assurance

A carve-out stands on the provider's controls. Ask the provider for its current SOC 2 report, or for equivalent assurance that its controls operate, and say which period you need. Keep the request and the reply with your supplier record.

• Then: Has it supplied one?

Decision

Has it supplied one?

Wait for the reply before the description is written. If the provider supplies a current report or equivalent assurance, read it. If it supplies nothing, or you do not know, take the cautious branch and ask whether the inclusive method is possible.

• Yes: Read the report on five points and write down what you find
• No, or not known: Will the provider support the inclusive method for the whole period?

Step

Read the report on five points and write down what you find

Does its period overlap yours, and is it Type 1 or Type 2? Does its system and category list match the service you use? What exceptions does it list? What must customers do? Which of its own providers did it carve out? Also check that its scope covers the service you buy, its dates are current and it names the company you contract with.

• Then: Can you rely on the controls you would assume it operates?

Decision

Can you rely on the controls you would assume it operates?

A Type 1 report says nothing about operation over time. A report on another product of the provider is not a report on yours. An exception on a control you assume is a risk to you. If you cannot rely on the provider's controls, the inclusive method or a change of provider is the honest answer.

• Yes: Carve it out and list the controls you assume it operates
• No, or not known: Will the provider support the inclusive method for the whole period?

Decision

Will the provider support the inclusive method for the whole period?

The inclusive method includes the provider's relevant controls in the description and the tests. You describe them like your own, with the provider's agreement that they may be tested. You need evidence from the provider for the CPA firm and its cooperation for the whole period.

• Yes: Use the inclusive method and describe its controls like your own
• No, or not known: Change the provider, or describe what you do to watch it

Step

Use the inclusive method and describe its controls like your own

Describe the provider's relevant controls as you describe yours, get its agreement that they may be tested, and plan the evidence it must give the CPA firm. Confirm the method with the CPA firm before the description is final.

• Then: Is another provider left to decide?

Step

Change the provider, or describe what you do to watch it

If you can neither rely on a carve-out nor include the provider, the pack's options are to change the provider or to describe what you do instead to watch it. Do not leave the question blank, because the CPA firm will ask. Ask the CPA firm what it can examine.

• Then: Is another provider left to decide?

Step

Carve it out and list the controls you assume it operates

Write the assumed controls as the provider describes them in its own report, and do not invent controls it does not state. In the pack's worked example the hosting provider is assumed to restrict physical access to data centres, protect the environment and power, patch the platform, and approve and review its staff's access.

• Then: Take the provider's own customer duties into your controls

Step

Take the provider's own customer duties into your controls

The report says what the provider's customers must do. Those are duties of yours. Add each to your own controls, or explain why it does not apply.

• Then: Decide how you will watch the provider, and how often

Step

Decide how you will watch the provider, and how often

A carve-out leaves you a duty to check that the assumed controls operate. Read its latest report for exceptions and for the duties it places on you, and check at the interval its tier sets. Start the reassessment before it is due, and reassess on a material change, an incident or a breach at the provider.

• Then: Is another provider left to decide?

Decision

Is another provider left to decide?

Decide each provider separately. A provider with no decision is a question the CPA firm will ask, so go round until every provider is outside, carved out, included or handled in another way you can describe.

• Yes: Does it run part of the system and affect the commitments? (back to an earlier step)
• No: Write the controls you assume customers operate

Step

Write the controls you assume customers operate

List the controls you assume customers operate so that yours work as described, written from your contracts and your customers' real duties. In the pack's worked example customers are assumed to remove their own leavers, protect their administrator credentials and review the approvers in their own workflows.

• Then: Is each one a duty customers can perform and have been told about?

Decision

Is each one a duty customers can perform and have been told about?

A control you assume customers operate must be one they can operate. Do not list one that is not in any contract or guide the customer receives, because a reader cannot rely on a duty nobody told them about. Customer controls invented to cover gaps are a common mistake.

• Yes: State each method and the assumed controls plainly in the description
• No, or not known: Tell customers in the contract or guide, or remove the control

Step

Tell customers in the contract or guide, or remove the control

Either put the duty in the contract or the guide customers receive and confirm they can perform it, or remove it from the list. Legal reviews the contract wording.

• Then: Is each one a duty customers can perform and have been told about? (back to an earlier step)

Step

State each method and the assumed controls plainly in the description

The description names each provider, the method used and, for a carve-out, the controls assumed of it, together with the controls customers must operate. Management writes it and the CPA firm examines it. When you send the report, remind the customer that it lists the controls assumed of customers and that its use depends on operating them.

• Then: Does a customer ask for a provider's own SOC 2 report?

Decision

Does a customer ask for a provider's own SOC 2 report?

A report you hold from your hosting provider is the provider's. It is not part of your own evidence, and you do not send it as if it were.

• Yes: Share it only as the provider's terms allow, as the provider's report
• No: Providers decided: name your report exactly and revisit each period

Outcome

Share it only as the provider's terms allow, as the provider's report

Check the provider's terms for who may receive the report, describe it as the provider's, and keep a record of what was sent. If the terms do not allow it, do not send it.

Outcome

Providers decided: name your report exactly and revisit each period

Name your own report by its exact type, categories, system and period. The description carries the method for each provider. Reconsider the method for a provider when the provider, its service or its report changes, and before each new period.