Bridge Letter & Management Response Templates
Templates for the letter that covers the time after a report period ends, for management's response to an exception, and for sharing a report under a confidentiality agreement.
Available soon
- Format
- Word
- Size
- 72 KB
- Length
- 25 pages
- Version
- 1.1
- Updated
What's inside
- How to use these templates
- Part 1: The bridge letter
- Part 2: Management's response to an exception
- Part 3: Sharing a SOC 2 report under confidentiality
- Part 4: What to tell a customer
- Part 5: A note on SOC 3
- Roles and responsibilities
- Common mistakes
- Related documents
- Definitions
- The EXAMPLE in one place: Acme
- Adapting these templates
- Framework references
Preview
The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded guidance boxes are for you to delete before approval. The cover and document control pages are in the file.
How to use these templates
Decide what the report is for. Draw the boundary around the service your customers rely on. Make the controls work and leave records before the period starts. Tell customers plainly what the report covers and what it does not.
These templates are for the time around a SOC 2 report: when a customer asks what has happened since the report's period ended, when the CPA firm finds an exception and management must respond, when a customer asks for the report itself, and when a customer asks about a report you do not yet hold. There are five parts. Each can be used alone.
Part | What it gives you | Use it when |
|---|---|---|
1. The bridge letter | The sections BL-01 to BL-12, the rule of days and words, a template letter and an EXAMPLE letter, and a release record | A customer holds your report and asks about the interval since its period ended |
2. Management's response to an exception | The sections MR-01 to MR-08, the five kinds of exception, the four statuses and an EXAMPLE | An exception has been found in a control, and management must say what it will do |
3. Sharing a SOC 2 report | The steps SH-01 to SH-08 and a log | A customer, prospect or customer's auditor asks for the report |
4. What to tell a customer | What to say and not say, and two reply templates | A customer holds ISO/IEC 27001 questions, or the report is not yet available |
5. A note on SOC 3 | How a SOC 3 report differs, and when to ask the CPA firm for one | You need something you can publish |
What these templates are not. A bridge letter is not an assurance, and the CPA firm does not issue or review it. It is not an AICPA document: it is market practice, and customers decide whether they accept one. A management response is not the CPA firm's finding, and the firm decides how an exception appears in the report. A reply to a customer is not a statement that you are certified or compliant. A SOC 2 report is an attestation by a licensed CPA firm, not a certificate. Nobody is “SOC 2 certified”, and no document in this pack says that you are or will be.
Legal note. This document helps an organisation get ready for a SOC 2 examination by a licensed CPA firm. It is not legal advice and not advice on an audit or attestation engagement. A SOC 2 report is the CPA firm's opinion on management's description of a system and on its controls. It is an attestation, not a certificate. This document does not say that you will receive any particular opinion, that any control meets a criterion, or that holding ISO/IEC 27001 or any other report equals or replaces a SOC 2 report. What the criteria require of you, how exceptions are described in the report and whether they affect the opinion are for the CPA firm to decide. Which customers accept which report is for them.
Who does what
- Examination owner runs the readiness work and the calendar, is the CPA firm's day-to-day contact, keeps the description, and reports the position in counts and words.
- Executive sponsor backs the examination with time and money, signs management's assertion with the examination owner, and decides scope questions that cost money.
- Legal reviews customer contracts and commitments, the engagement letter, the bridge letter and what is shared under a confidentiality agreement.
- Customer-facing lead tells customers where the report stands, using the approved words, and sends the bridge letter only when the owner releases it.
- Head of Information Security owns the security controls, the risk assessment and the incident process; does not test their own controls (P20 CA-10).
- Control owner performs the control as written, keeps the record it leaves, and answers the auditor's requests for that evidence.
The rules these templates put into practice
SR-01 A SOC 2 report is an attestation, not a certificate. Say “we have a SOC 2 Type 2 report for the period 1 January to 30 June” and never “we are SOC 2 certified” or “SOC 2 compliant”. Name the type, the categories, the system and the period.
SR-17 Record an exception when it is found, with its cause, its date and the management response. Never remove it from the evidence. The CPA firm decides how it appears in the report.
SR-20 A bridge letter is management's statement for the interval after a period ends. It carries no assurance from the CPA firm. State what it covers, what has changed and what you do not say. Use it for a limited gap, about [[3]] months (market practice), and not in place of a next report.
SR-21 Share a SOC 2 report only under a confidentiality agreement or the terms the report states for its use (P26 QG-14), by the sharing tier P26 sets, and name it by its exact type, scope and dates when you describe it (P26 QG-10). A SOC 3 report is the version for general use.
SR-22 ISO/IEC 27001 certification and a SOC 2 report are different things, from different bodies, about different subjects. Neither equals or replaces the other. Say what you hold and let the customer decide what it accepts (P08, P26).
Four rules of the customer-evidence pack apply and are cited by ID: P26 QG-10 (how a certificate or report is named), P26 QG-13 (release by sharing tier), P26 QG-14 (a document that belongs to a supplier is shared only as the supplier's terms allow) and P26 QG-17 (every commitment made in or around a response is logged). They are not restated here. The documents of that pack that these templates use are P26-A05 Evidence & Attestation Library Index, P26-A08 Customer-Facing Security Overview Document and P26-A09 Standard Security Commitments Schedule.
Incidents. Where a letter or a reply touches an incident, the incident plan decides who decides and who is told, and when (P09-A03 Incident Response Plan). These templates change no decision right and state no notification clock.
Guidance — delete before approval
Keep every letter, response and reply you send, with its release record, for the period your records policy sets. A customer may ask what you said and when.
Do not use a template as a form for a customer to fill in. They are for you. Delete the guidance boxes and the EXAMPLE passages before anything leaves the company.
Part 1: The bridge letter
What a bridge letter is, and what it is not
A letter from your management that covers the interval after a report period ends. The CPA firm does not issue it, performs no procedures on the interval and gives no assurance over it. Market practice, not an AICPA document.
- It is management's statement. It is signed by an executive who speaks for management, and it is the company's own.
- The CPA firm did not issue it, did not review it, performed no procedures on the interval and gives no assurance over it (SR-20).
- It is not an AICPA document. No AICPA definition or rule for it was found when this pack was written. It is market practice, and customers decide whether they accept one.
- About three months after the period ends is the limit advisory sources usually give. That is market practice and not a rule. Many customers also look for a report whose period ended within the last 12 months (market practice). Ask each customer what it accepts.
- It creates no commitment beyond the standard security commitments schedule (P26-A09 Standard Security Commitments Schedule). Any date in it is logged as a commitment (P26 QG-17).
When to use one, and when not to
Use a bridge letter when:
- The report has been issued and the customer holds it, and the customer has asked what has happened since the period ended.
- The gap between the end of the period and today is within what your customers accept. About three months is market practice, and the customer decides (SR-20).
- Management can say, from its own monitoring and its own records, how the controls have run since the period ended.
Do not use one:
- To stand in for the next report once the interval is longer than the customer will accept. A letter bridges a limited gap. It does not replace a report.
- Before the report exists. Nothing has been issued to bridge from. Tell the customer where the report stands, in plain words (part 4).
- While the period is still running. The period is not over, so there is no interval to describe.
- When management cannot honestly say how the controls have run. A letter that says less is better than one that says what nobody checked.
- To make a statement about a system, a category or a provider that the report does not cover. The letter refers to the report and stays inside it.
The rule of days and words
The rule has one input, the last day of the period, and one question: what is today's position? It answers in one of four words, and counts the days of the gap. The words are the facts' words, and they are used in the calendar (Observation Period & Exceptions Calendar) as well.
Word | When | Days since the period ended | What to do |
|---|---|---|---|
Period still running | On or before the last day of the period | 0 | There is no interval yet. Do not send a letter. Say when the period ends and when the report is expected. |
Bridge letter suitable | From the day after the period ends to the last day of the third calendar month after it (about three months, market practice) | 1 to 92 in the EXAMPLE (the number of days depends on the months) | A letter may be sent with the report, approved on the release record. The customer decides whether to accept it. |
Beyond a bridge letter: send the next report | After that, until the next report is issued | 93 or more in the EXAMPLE | A letter alone no longer closes the gap. If the next report has been issued, send it. If not, say when it is expected, log the date as a commitment, and leave the customer to decide what to rely on. |
Next report issued | On or after the day the next report is issued | The gap ends; its length is the days from the period end to the issue of the next report | The next report takes the place of the letter. Stop sending letters for the old period. |
The words describe where a letter stands. They do not say that the CPA firm has accepted anything, and the customer decides what it accepts. The third word names what a letter can no longer do. If the next report has been issued, send it. If it has not, tell the customer plainly when it is expected, and do not stretch the letter.
Worked example: a period that ended on 30 June 2027
EXAMPLE. Acme Corp (EXAMPLE) has a Type 2 report for the period 1 January 2027 to 30 June 2027. The report is expected about 30 August 2027 (two months after the period ends, a house default). Its next period runs from 1 July 2027 to 31 December 2027, and the next report is expected about 29 February 2028. The table shows the rule on seven dates.
Date | Next report | Days of the gap | Word |
|---|---|---|---|
15 June 2027 | Not yet issued | 0 | Period still running |
30 June 2027 | Not yet issued | 0 | Period still running |
15 August 2027 | Not yet issued | 46 | Bridge letter suitable |
20 September 2027 | Not yet issued | 82 | Bridge letter suitable |
30 September 2027 | Not yet issued | 92 | Bridge letter suitable |
1 October 2027 | Not yet issued | 93 | Beyond a bridge letter: send the next report |
1 March 2028 | Issued 29 February 2028 | 244 | Next report issued |
The letter below is dated 20 September 2027: day 82 of the gap, inside the window of 92 days, and after the report was issued. On 1 October 2027 the rule says Beyond a bridge letter, and a new letter would not be suitable. On 1 March 2028, after the next report is issued, the gap has ended. The rule looks only at dates. On 15 August 2027 it says Bridge letter suitable, but the report is not expected until 30 August 2027, so there is nothing yet to bridge from. A letter is sent with or after the report. Before it, use the reply in part 4.
The twelve sections of the letter
A bridge letter has twelve sections, BL-01 to BL-12. Eleven are required. BL-07 is optional and is used when the report mentioned an exception. BL-12 is the approval before release, which is recorded in your file and not printed in the letter.
Section | What it says | What to write, and what to avoid |
|---|---|---|
BL-01 Who is writing and to whom Required | The service organisation's name, the signatory's name and role, the date, and the addressee. | Write. Name the service organisation, the signatory (an executive who speaks for management) and the customer, and date the letter. Avoid. Do not sign for the CPA firm, and do not use its letterhead. |
BL-02 The report it refers to Required | The report by its exact type, the CPA firm, the system, the categories and the period it covers, with the end date. | Write. Name the report exactly: type, CPA firm, system, categories, and the first and last day of the period (SR-01, P26 QG-10). Avoid. Do not shorten the name to "our SOC 2" or add a word the report does not use. |
BL-03 The interval it covers Required | From the day after the period ended to the date of the letter. | Write. Say the interval runs from the day after the period ended to the date of the letter. Avoid. Do not leave the end of the interval open. A letter that speaks of "since the period" without a date cannot be tested. |
BL-04 What management states about the interval Required | That, to the best of management's knowledge, the controls described in the report have continued to operate, except as stated below. | Write. State what management knows about whether the controls described in the report have continued to operate, with the exceptions listed below. Avoid. Do not write a stronger sentence than your records support, and never say that the controls "are effective". That is the CPA firm's kind of opinion. |
BL-05 Changes in the interval Required | Any significant change to the system or its controls, with the date, or a statement that there has been none. | Write. List each significant change to the system or its controls in the interval, with the date, or say that there has been none (SR-18). Avoid. Do not leave it out because the change was planned. The reader wants to know what is different from the report. |
BL-06 Incidents in the interval Required | Any security incident that affected a commitment, described as the company would describe it to a customer, or a statement that there has been none. | Write. List each security incident that affected a commitment, described as you would describe it to the customer, or say that there has been none (SR-19). Avoid. Do not decide in this letter whom to notify or how fast. That follows the incident plan and Legal, unchanged (P09-A03). Do not restate any notification time. |
BL-07 Exceptions and open items from the report Optional | The state of any exception the report mentioned and the management response. | Write. Where the report mentioned an exception, say what has happened to it since: its status in the words of the exception statuses, and the dates (A08). Avoid. Do not describe an exception as closed until it is fixed and retested. |
BL-08 What the letter is not Required | That the CPA firm did not examine the interval, gives no assurance over it, and did not issue or review the letter. | Write. Say that the letter is management's statement, that the CPA firm did not examine the interval or give assurance over it, and did not issue or review the letter. Avoid. Do not soften this. It is the line that keeps the letter honest (SR-20). |
BL-09 The next report Required | The next period's dates and the expected date of the report. | Write. Say when the next period runs and when the next report is expected, as an expectation. Avoid. Do not promise a date. Any date you give a customer is a commitment to log (P26 QG-17). |
BL-10 Limits of use Required | That the letter is for the named customer only, under the confidentiality terms in place, and may not be forwarded. | Write. Say that the letter is for the named customer only, under the confidentiality terms in place, and may not be forwarded. Avoid. Do not send it to a recipient who is not covered by a confidentiality agreement (SH-03). |
BL-11 Validity Required | That the letter speaks as of its date and is not updated. | Write. Say that the letter speaks as of its date and will not be updated. Avoid. Do not offer to update it. A new letter is a new record, with its own approval. |
BL-12 Approval before release Required | The names of the approvers and the date, recorded in the file and not in the letter. | Write. Do not print this section in the letter. Record the approvers and the date in your file, on the release record below. Avoid. Do not put approver names or approval dates in the letter: a customer would read them as status the CPA firm has not given. |
The template letter
Copy the text of each section into your own letter and replace the placeholders. Keep the order. Remove the section IDs from the letter you send.
Section | Text of the letter |
|---|---|
BL-01 | [[YYYY-MM-DD]] To: [[customer and contact]] From: [[name and role of the signatory]], [[service organisation]] Subject: Bridge letter for the SOC 2 report on [[system]] |
BL-02 | This letter refers to the SOC 2 [[Type 1 / Type 2]] report on [[system]] of [[service organisation]], issued by [[name of the CPA firm]] on [[date]], for the [[categories]] categories, for the period [[start date]] to [[end date]] (the report). |
BL-03 | This letter covers the interval from [[the day after the period ended]] to the date of this letter (the interval). |
BL-04 | To the best of management's knowledge, the controls described in the report have continued to operate as described during the interval, except as stated below. |
BL-05 | Significant changes in the interval: [[each change with its date, or: There has been no significant change to the system or its controls in the interval.]] |
BL-06 | Incidents in the interval: [[each incident that affected a commitment, described plainly, or: No security incident in the interval has affected a commitment described in the report.]] |
BL-07 | Exceptions and open items from the report: [[for each exception: what it was, its status in the words of the exception statuses, and the dates; or delete this section if the report mentioned none]] |
BL-08 | This letter is management's statement. [[Name of the CPA firm]] has not examined the interval, gives no assurance over it, and did not issue or review this letter. |
BL-09 | The next report: the next examination period runs from [[start date]] to [[end date]]. The report is expected on or about [[date]]. This is an expectation and not a commitment. |
BL-10 | This letter is for [[customer]] only, under the confidentiality terms in place between us, and may not be forwarded. |
BL-11 | This letter speaks as of its date and will not be updated. |
BL-12 | Not printed. The approvers and the date are recorded on the release record. |
The EXAMPLE letter
EXAMPLE, not part of the template. A letter of Acme, on its first Type 2 report. The dates come from the rule above.
Section | Text of the letter |
|---|---|
BL-01 | 20 September 2027 To: [[Customer]] (EXAMPLE), finance operations From: [[name]], Chief Technology Officer (EXAMPLE), Acme Corp (EXAMPLE) Subject: Bridge letter for the SOC 2 report on Ledgerline |
BL-02 | This letter refers to the SOC 2 Type 2 report on Ledgerline of Acme Corp (EXAMPLE), issued by [[name of the CPA firm]] on 30 August 2027, for the Security, Availability and Confidentiality categories, for the period 1 January 2027 to 30 June 2027 (the report). |
BL-03 | This letter covers the interval from 1 July 2027 to the date of this letter, 20 September 2027 (the interval). |
BL-04 | To the best of management's knowledge, the controls described in the report have continued to operate as described during the interval, except as stated below. |
BL-05 | Significant changes in the interval: on 3 August 2027 the identity provider used for production access moved to a new version. Its configuration and the controls described in the report did not change. |
BL-06 | Incidents in the interval: no security incident in the interval has affected a commitment described in the report. |
BL-07 | Exceptions and open items from the report: the report describes one exception, a quarterly review of production access performed 20 days after the date the control states. Management named a deputy reviewer on 14 May 2027. The review for the second quarter was performed on 12 July 2027, within its time. Status: Management response agreed. The retest is planned after the review for the third quarter, due 15 October 2027. |
BL-08 | This letter is management's statement. [[Name of the CPA firm]] has not examined the interval, gives no assurance over it, and did not issue or review this letter. |
BL-09 | The next report: the next examination period runs from 1 July 2027 to 31 December 2027. The report is expected on or about 29 February 2028. This is an expectation and not a commitment. |
BL-10 | This letter is for [[Customer]] (EXAMPLE) only, under the confidentiality terms in place between us, and may not be forwarded. |
BL-11 | This letter speaks as of its date and will not be updated. |
BL-12 | Not printed. The approvers and the date are recorded on the release record. |
The release record
A letter is released only after these checks, recorded in your file. The record holds the names of the approvers and the date. The letter holds neither (BL-12).
Check before release | Done by | Result and date |
|---|---|---|
The report is named exactly as it reads: type, firm, system, categories and the first and last day of the period (SR-01, P26 QG-10). | Examination owner | |
The state of the bridge rule is Bridge letter suitable on the date of the letter (the table of days and words). | Examination owner | |
Changes in the letter agree with the change records and with the description's changes section (A03 DS-12). | Head of Engineering | |
Incidents in the letter agree with the incident log (P09-A09). The wording was cleared by Legal. No notification time is stated. | Head of Information Security | |
Exceptions in the letter agree with the exceptions calendar (A08), in the exception status words. | Examination owner | |
The letter promises nothing beyond the standard security commitments schedule (P26-A09). Any date in it is logged as a commitment (P26 QG-17). | Legal | |
The recipient is covered by a confidentiality agreement on the day of sending (SH-03). | Legal | |
The letter says that the CPA firm gave no assurance, did not examine the interval and did not issue or review the letter (BL-08). | Legal | |
The signatory has read the letter and has a basis for BL-04 from monitoring records. | Executive sponsor | |
The approvers and the date are recorded here, and not in the letter (BL-12). | Examination owner |
Item | Entry |
|---|---|
Approved by (executive), and the date | [[name and role; YYYY-MM-DD]] |
Checked by, and the date | [[names; YYYY-MM-DD]] |
Sent to, by which route, on | [[recipient; route; YYYY-MM-DD]] |
Commitments logged (P26 QG-17) | [[reference of the log entry for any date given]] |
Guidance — delete before approval
The basis for BL-04 is your own monitoring: the checkpoints and the exceptions calendar (A08), the incident log (P09-A09), the change records and the access reviews. Read them for the interval before the signatory signs. If you cannot read them, you do not yet have a basis.
If a letter is asked for after the window has closed, do not stretch it. Say plainly when the next report is expected and send the report you hold with its period named exactly.
Where the report held an exception that is still open, say so in BL-07 in the status words. An open exception that is not mentioned is the kind of omission a customer remembers.
Part 2: Management's response to an exception
A test result in which a control did not operate as described for a sampled occurrence. Some sources call these deviations. The auditor decides how one is described in the report. Management records the cause and its response, and also records those it finds itself in the period. Management responds to each exception, and the response is kept with the exception (SR-17). The CPA firm decides whether and how an exception and the response appear in the report. Ask the firm whether and where the report prints management's response, and what wording it uses to separate it from the firm's own opinion. Practice varies.
An exception does not by itself decide the opinion. Some exceptions leave an unqualified opinion and some lead the firm to qualify it. The opinion is the CPA firm's professional judgement on the whole examination, so management cannot set it or negotiate it. Ask the firm early how it expects to treat the exception.
SR-17 Record an exception when it is found, with its cause, its date and the management response. Never remove it from the evidence. The CPA firm decides how it appears in the report.
A gap found by your own readiness assessment is a finding and not an exception (A06). An exception is a result of a test of a sampled occurrence. If you find one yourself during the period, record it when it is found, and tell the CPA firm.
The five kinds of exception
Name the kind first. It tells the reader what the response must say.
Kind | What it means | What the response must say, and what to avoid |
|---|---|---|
EK-1 Control not performed | No occurrence at all in the sampled item. | Say. Say whether the occurrence was missed or not recognised, and what showed it. Say what the control does now to make sure the next occurrence is not missed. Avoid. Do not say "an oversight" and stop. A missed control has a cause that can be named. |
EK-2 Performed late | Performed, but after the time the control states. | Say. Say how late, why, and what stops it recurring (a deputy, a reminder, a change of the due date if the due date was wrong). Avoid. Do not move the due date after the fact to make the occurrence on time. A changed control is a change (EK-5). |
EK-3 Performed without evidence | Performed, but no record that the auditor could inspect. | Say. Say that the work was done, show what shows that, and say what record will exist from now on. Avoid. Do not rebuild a record afterwards and present it as one made at the time (SR-09). |
EK-4 Performed by the wrong person | Performed by someone other than the owner or approver the control states. | Say. Say who did it, who should have, and why. Say whether the control needs a deputy or a different approver. Avoid. Do not blame the person. Look at how the control assigned the work. |
EK-5 Control changed in the period | The control was redesigned. Also a significant change to record (DC-9). | Say. Say what changed, when, and why. Record it also as a significant change (DC-9, SR-18) and tell the CPA firm. Avoid. Do not describe the change as a fix of an exception unless the exception came first. |
The four statuses
Every exception has exactly one of four statuses at any time. They are the words of the exceptions calendar (A08). The status is updated when it changes, and the history is kept.
Status | Meaning |
|---|---|
Open | The exception is recorded and no response is agreed yet. |
Management response agreed | The response is written and approved, and the work is under way or done but not yet retested. |
Fixed and retested | The fix is made, has operated for a while, and a retest by someone other than the owner found no gap (P20 CA-14). |
Accepted and described | Management accepts the gap, with the approval the risk process sets (P05 RM-08), and the description says what is and is not done. |
The eight sections of the response
A response has eight sections, MR-01 to MR-08. The exceptions calendar keeps five fields for each exception. The second table shows which sections hold them.
Section | What it says | What to write, and what to avoid |
|---|---|---|
MR-01 The exception | The control, the test, the occurrence and the date, as the CPA firm described it to you. | Write. State the control, the test, the occurrence and the date, in the words the CPA firm used to describe it to you. Avoid. Do not restate the exception in kinder words. The response is to the exception as it was found. |
MR-02 Cause | Why it happened, in plain words and without blame. | Write. State why it happened, in plain words and without blame. Avoid. Do not list several causes to dilute one. Name the main cause, and others only if they are real. |
MR-03 Effect | What it meant for customers and for the commitments, or that there was no effect. | Write. State what it meant for customers and for the commitments, or say that there was no effect, and how you know. Avoid. Do not write "no effect" without a basis. Say what you checked. |
MR-04 What management did | What was done, by whom and when. | Write. State what was done, by whom and when. Avoid. Do not describe intentions here. What is planned goes in MR-05. |
MR-05 What management will do | What will change, with an owner and a date. | Write. State what will change, with an owner and a date. Avoid. Do not name a team. Name one owner, and a date that the owner agreed. |
MR-06 When it was or will be retested | The date of the retest, after the fixed control has operated for a while. | Write. State when the fixed control will be retested, after it has operated for a while (P20 CA-14), and by whom (not the owner). Avoid. Do not set the retest for the day after the fix. |
MR-07 Status | One of the exception statuses (A08). | Write. Choose one of the four exception statuses, and update it when it changes. Avoid. Do not invent a fifth. If none fits, the response is not yet agreed. |
MR-08 Approval | The executive who approved the response and the date. | Write. State the executive who approved the response and the date, in your file. Avoid. Do not print the approval in anything a customer receives as if it were the CPA firm's. |
Field in the calendar | Held in sections |
|---|---|
Cause | MR-02 |
What management did or will do | MR-04, MR-05 |
Owner | MR-05, MR-08 |
Date | MR-04, MR-05, MR-06, MR-08 |
Effect on customers, if any | MR-03 |
The template
Section | Entry |
|---|---|
MR-01 The exception | [[your entry]] |
MR-02 Cause | [[your entry]] |
MR-03 Effect | [[your entry]] |
MR-04 What management did | [[your entry]] |
MR-05 What management will do | [[your entry]] |
MR-06 When it was or will be retested | [[your entry]] |
MR-07 Status | [[your entry]] |
MR-08 Approval | [[your entry]] |
The EXAMPLE response
EXAMPLE, not part of the template. A response of Acme, written on 17 May 2027 for an exception it found in its own checks during the period and told the CPA firm about. Dates are invented.
Section | Entry |
|---|---|
MR-01 The exception | Control: quarterly review of production access by the Head of Engineering, completed within 15 days of quarter end. Test: the review for the first quarter of 2027. Occurrence: completed on 5 May 2027, 20 days after 15 April 2027. Kind: EK-2, performed late. |
MR-02 Cause | The reviewer was on leave in the first two weeks after quarter end, and the control named no deputy. |
MR-03 Effect | No effect on customers. The review found two accounts of departed contractors, which had not been used since they left (checked in the access logs), and both were removed on the day of the review. |
MR-04 What management did | The review was completed on 5 May 2027 and the two accounts were removed on the same day. A deputy reviewer was named on 14 May 2027. |
MR-05 What management will do | The Head of Engineering will add a calendar reminder for the due date and a check on the fifth working day after quarter end, from 31 May 2027. Owner: Head of Engineering. |
MR-06 When it was or will be retested | A retest by the assessor, who does not perform the control, after the review for the third quarter, due 15 October 2027, which will be the second occurrence since the fix (P20 CA-14). |
MR-07 Status | Management response agreed. (To be updated to Fixed and retested when the retest finds no gap.) |
MR-08 Approval | Approved by the executive sponsor. The name and the date are recorded in the file, not in what customers receive. |
Guidance — delete before approval
A response is a short document, usually a page. Write it when the exception is found, update the status as the work moves, and keep every version. The retest follows P20-A08 Control Deficiency & Remediation Tracker and P20 CA-14: a closed exception needs a retest by someone other than its owner.
If management does not agree that the occurrence was an exception, say so, and give the facts. The CPA firm decides. Do not argue in the response. Give the evidence.
If the exception is accepted, the status is Accepted and described, with the approval the risk process sets (P05 RM-08), and the description says what is and is not done.
Part 3: Sharing a SOC 2 report under confidentiality
A SOC 2 report is generally restricted in use, and who may receive it is for the CPA firm to state in the report itself. Share it only under a confidentiality agreement or the terms the report states (SR-21), by the sharing tier your evidence index sets, and name it by its exact type, categories, system and period when you describe it. The steps below are SH-01 to SH-08. They use the customer-evidence documents of the earlier pack: P26-A05 Evidence & Attestation Library Index holds the entry for the report and its tier, P26-A08 Customer-Facing Security Overview Document is what customers receive without the report, and P26-A09 Standard Security Commitments Schedule is what you commit to.
SR-21 Share a SOC 2 report only under a confidentiality agreement or the terms the report states for its use (P26 QG-14), by the sharing tier P26 sets, and name it by its exact type, scope and dates when you describe it (P26 QG-10). A SOC 3 report is the version for general use.
The tiers are Public, Under NDA, Summary only and Never shared. The tier of the report is set in the evidence index by the people P26 names, not in this procedure. A change of tier is not made here. Release follows the tier (P26 QG-13).
Step | Who | What to do and check | Record | Rule |
|---|---|---|---|---|
SH-01 Check who is asking and why | Customer-facing lead | A named customer, for a stated purpose, with a reason to see the report. Who is asking, for what purpose, and why they need the report and not the overview (P26-A08). A customer, a prospect in a procurement, or an auditor of a customer: each is a different request. | The request, in the customer's words, in the evidence index entry | |
SH-02 Check the terms for use | Examination owner | The report states who may receive it. Follow it, and ask the CPA firm if unsure. What the report says about who may receive it and for what use. Where it is unclear, ask the CPA firm. Do not guess. | A note of what the report says, and of any question put to the CPA firm | SR-21 |
SH-03 Confirm a confidentiality agreement is in place | Legal | Use the customer's or your standard one. Legal confirms. Whether a confidentiality agreement covers the recipient on the day the report is sent: the customer's or your own standard one. | The agreement reference and its date | |
SH-04 Set the sharing tier | Head of Information Security | Follow P26's sharing tiers. The report is released as that tier allows (P26 QG-13, QG-14). The sharing tier set for the report in the evidence index (P26-A05). The Head of Information Security releases the report as that tier allows (P26 QG-13). A change of tier is not made here. | The tier, and the release, in the index | SR-21 |
SH-05 Name the report exactly | Examination owner | By type, categories, system and period (P26 QG-10). How the report is named in the message and in the log: type, categories, system and period, exactly as it reads (P26 QG-10, SR-01). Never "our SOC 2" without the rest. | The exact name used | SR-01 |
SH-06 Send it by a controlled route | Head of Information Security | A secure link or portal with an expiry, not an open attachment. The route: a secure link or portal with an expiry, and with download disabled where the portal allows. Not an open attachment, and not a message to a personal address. | The route and the expiry date | |
SH-07 Include the bridge letter if the period has ended | Examination owner | Only when the gap is within what a bridge letter covers (SR-20). Whether the period has ended and the gap is within what a bridge letter covers (the table of days and words). If so, the letter goes with the report, approved on the release record. If not, say when the next report is expected. | The bridge letter reference, or the reason none was sent | SR-20 |
SH-08 Log it | Examination owner | Record who received which report and when in the evidence index (P26 A05). Who received which report, when, by which route, under which agreement and with which letter, in the evidence index (P26-A05). | The log entry |
The sharing log
Each release is a line in the evidence index (P26-A05 Evidence & Attestation Library Index). This is the line, so that the log has the same shape whatever tool holds it.
Date | Customer and recipient | Report named exactly (type, categories, system, period) | Tier and agreement | Route and expiry | Bridge letter |
|---|---|---|---|---|---|
[[YYYY-MM-DD]] | [[customer; recipient]] | [[SOC 2 Type 2 report on the system, categories, period]] | [[Under NDA; agreement reference]] | [[secure link; expiry date]] | [[reference, or: none, with reason]] |
Guidance — delete before approval
If the report you are asked for is a provider's report that you hold (for example your hosting provider's), it is the provider's. Share it only as its terms allow, and describe it as the provider's (P26 QG-14). Do not send it as part of your own evidence.
When you send the report, remind the customer that it lists the controls it assumes customers operate (complementary user entity controls), and that its use of the report depends on operating them. The list is in the description of the system (A03, DS-11).
Nothing in this procedure changes who may be told what about an incident, or when. That is the incident plan's, and Legal's.
Part 4: What to tell a customer
Customers ask three kinds of question: whether you are certified, whether something else you hold is enough, and when they will have the report. The answers are simple, and mostly about being exact. Name what you hold by its exact type, categories, system and period (SR-01, P26 QG-10). Let the customer decide what it accepts (SR-22).
SR-22 ISO/IEC 27001 certification and a SOC 2 report are different things, from different bodies, about different subjects. Neither equals or replaces the other. Say what you hold and let the customer decide what it accepts (P08, P26).
Never say
These sentences are not true and are never to be used. A SOC 2 report is an attestation, not a certificate, and ISO/IEC 27001 is a different thing from a SOC 2 report.
Do not say |
|---|
“We are SOC 2 certified.” |
“We are SOC 2 compliant.” |
“Our ISO/IEC 27001 certificate equals SOC 2.” |
“Our SOC 2 replaces ISO/IEC 27001.” |
Questions customers ask, and plain answers
The customer asks | A plain answer | What goes wrong |
|---|---|---|
"Are you SOC 2 certified?" | A SOC 2 report is an attestation by a licensed CPA firm, not a certificate. Say what you have: "We hold a SOC 2 Type 2 report on [[system]] for [[categories]], for the period [[start]] to [[end]]." Or, if you have none yet: "We are working toward one. The period is [[start]] to [[end]] and the report is expected about [[date]]." | Saying yes, or saying "almost". Neither is true. |
"Are you SOC 2 compliant?" | The criteria are not a compliance regime, and holding a report does not make anyone compliant. Say what the report is about and what it does not, and offer it under a confidentiality agreement. | Agreeing, because the customer used the word. |
"We have your ISO/IEC 27001 certificate. Is that enough?" | They are different things from different bodies about different subjects. Neither replaces the other, and what a customer accepts is the customer's decision (SR-22). Say what each is, and offer both where you hold both. | Telling the customer that one equals the other, in either direction. |
"When will we get the report?" | Give the expected date as an expectation. It depends on the period and on the CPA firm (A08). Log the date you gave as a commitment (P26 QG-17). | Promising a date the calendar does not support. |
"Send us last year's report." | Send the report you hold, named exactly, under the confidentiality terms, with a bridge letter if the gap is within what the customer accepts (part 1). | Sending an older report with no word about the interval since. |
"Can we forward it to our own customers or auditor?" | Not unless the report's terms and your confidentiality agreement allow it (SR-21). A report for general use is a SOC 3 report (part 5). | Agreeing without reading the report's terms of use. |
Reply templates
Use one of the two replies as a start, and replace the placeholders. Legal reads the wording before the first use. Log any date you give as a commitment (P26 QG-17).
Reply 1: the report is not yet available |
|---|
Subject: Our SOC 2 report for [[system]] |
Thank you for asking about our SOC 2 report. We do not yet hold one for [[system]]. [[We have engaged / We are choosing]] a licensed CPA firm for a SOC 2 [[Type 1 / Type 2]] examination covering [[categories]]. The examination period is [[start date]] to [[end date]], and we expect the report on or about [[date]]. That date is an expectation. |
Meanwhile we can send our security overview and our standard security commitments schedule, which describe what we do and what we commit to today. We can also complete your security questionnaire. |
When the report is issued we will send it under a confidentiality agreement, and we will describe it exactly by its type, categories, system and period. Please tell us if there is a date after which you can no longer rely on a plan alone, and we will tell you plainly whether we can meet it. |
Reply 2: the customer asks about ISO/IEC 27001, or holds questions based on it |
|---|
Subject: Our ISO/IEC 27001 and SOC 2 position |
Thank you for your questions, which follow ISO/IEC 27001. [[We hold an ISO/IEC 27001 certificate: name it by its exact title, scope, issuer and dates (P26 QG-10). / We do not hold an ISO/IEC 27001 certificate. Say what you do hold, and what you operate.]] We have answered your questions in the attached response. |
A SOC 2 report is a different thing. It is an attestation by a licensed CPA firm on management's description of one system and on its controls, against criteria published by the AICPA. [[We hold a SOC 2 Type 2 report on the system named in the report, for the categories and the period it states. We can send it under a confidentiality agreement. / We are working toward one, and say the period and the expected date as Reply 1 does.]] |
The two are issued by different bodies and are about different subjects, and neither replaces the other. We do not claim that one answers the questions of the other. Where you want a specific control, tell us, and we will answer it on its own terms. |
Guidance — delete before approval
Use the customer-facing security overview (P26-A08 Customer-Facing Security Overview Document) for the facts about what you do, and the standard commitments schedule (P26-A09 Standard Security Commitments Schedule) for what you commit to. This pack gives you words for the SOC 2 report, and those documents give you the rest.
If a customer's questionnaire is based on ISO/IEC 27001, answer the questions on their own terms and state the SOC 2 position separately. Do not tell the customer which SOC 2 criteria an ISO/IEC 27001 control relates to. This pack does not say that, and neither should a reply.
If you do not hold the certificate or the report that a customer assumes you hold, say so in the first sentence, and say what you do hold.
Part 5: A note on SOC 3
A SOC 3 report covers the same subject matter as a SOC 2 report in less detail, without the description of the tests and results, and its use is not restricted. It is the version for general use. If you need something you can show on a website or give to a prospect without a confidentiality agreement, ask the CPA firm early whether it can issue one, and at what cost. The scoping assessment asks the question (A02, SQ-13).
SOC 2 report | SOC 3 report | |
|---|---|---|
What it is | The CPA firm's report on management's description of the system and the controls, with the tests and results (Type 2). | A report on the same subject matter in less detail, without the description of tests and results. |
Who may use it | Generally restricted: the report states who may receive it. | Not restricted. It is the version for general use. |
Who issues it | The CPA firm, under an engagement. | The CPA firm, as a separate report. It comes only with a Type 2 examination, so there is none for a Type 1 report. Whether it is available to you, and at what cost, is for the firm to say. |
Where it helps | A customer who must assess your controls and exceptions. | A website, a procurement page or a prospect who needs a short, public statement. |
What you must still do | Share under confidentiality (SR-21) and name it exactly (SR-01). | Name it exactly, and publish it only as issued. It is the firm's report, and not a summary you write. |
The sources read for this pack describe a SOC 3 report only in outline (the Journal of Accountancy, 2016). The firm confirms what a SOC 3 report is for your engagement.
Roles and responsibilities
Role | What they do with these templates |
|---|---|
Examination owner [[name; often the Head of Information Security or a compliance lead]] | Runs the readiness work and the calendar, is the CPA firm's day-to-day contact, keeps the description, and reports the position in counts and words. |
Executive sponsor [[e.g. chief technology officer or chief operating officer]] | Backs the examination with time and money, signs management's assertion with the examination owner, and decides scope questions that cost money. |
Legal [[in-house or external counsel]] | Reviews customer contracts and commitments, the engagement letter, the bridge letter and what is shared under a confidentiality agreement. |
Customer-facing lead [[head of sales or customer success]] | Tells customers where the report stands, using the approved words, and sends the bridge letter only when the owner releases it. |
Head of Information Security [[the role the earlier packs call the Head of Information Security]] | Owns the security controls, the risk assessment and the incident process; does not test their own controls (P20 CA-10). |
Control owner [[the person who performs or supervises the control]] | Performs the control as written, keeps the record it leaves, and answers the auditor's requests for that evidence. |
The matrix shows who is responsible (R), accountable (A), consulted (C) and informed (I); A/R is both. Columns, in order: Spons for executive sponsor; Owner for examination owner; Legal for Legal; Cust for customer-facing lead; Sec for Head of Information Security; Ctrl for control owner. Each activity has one accountable role.
Activity | Spons | Owner | Legal | Cust | Sec | Ctrl |
|---|---|---|---|---|---|---|
Draft the bridge letter | I | A/R | C | C | C | |
Check the letter against the logs and records | A | C | R | C | ||
Approve and sign the bridge letter (BL-12) | A/R | R | C | C | ||
Send the letter and the report | A | C | R | C | ||
Write a management response (MR-01 to MR-07) | A | I | C | R | ||
Approve a management response (MR-08) | A/R | R | C | C | ||
Release a report by its tier (SH-04) | C | C | I | A/R | ||
Check the confidentiality agreement (SH-03) | I | A/R | I | C | ||
Reply to a customer about the report | A | C | R | C |
Common mistakes
Mistake | What to do instead |
|---|---|
The bridge letter is written as if the CPA firm stood behind it (SR-20). | Say in the letter that the firm gave no assurance, did not examine the interval and did not issue or review it (BL-08). |
A bridge letter is sent for a gap of nine months. | Use a letter for a limited gap, about three months (market practice), and tell the customer when the next report is expected. |
The letter says the controls are effective. | Say what management knows about whether they have continued to operate, and nothing more. |
An exception is called closed because the fix was made. | It is Fixed and retested only after a retest by someone other than the owner (P20 CA-14). |
The management response blames a person. | State the cause as a fact about how the control was set up, and say what changes. |
The report is sent as an open attachment to anyone who asks. | Follow the steps SH-01 to SH-08: purpose, terms, agreement, tier, name, route, letter and log. |
The company claims a certificate for its report, or says that its ISO/IEC 27001 certificate makes the report unnecessary (SR-01, SR-22). | Say what you hold, named exactly, and let the customer decide what it accepts. |
A promised date for the report is not recorded. | Log it as a commitment with an owner (P26 QG-17) and report it when it is at risk. |
Related documents
Document | Relationship |
|---|---|
System Description & Boundary Template | The description whose period and changes the bridge letter refers to (DS-12) |
Readiness Assessment Procedure | Where a gap found before the period is a finding and not an exception |
Observation Period & Exceptions Calendar | The calendar of dates, the log of exceptions and the milestones for the bridge letter |
SOC 2 Report Scoping Assessment | The question on a report for general use (SQ-13), and the report types |
P26-A05 Evidence & Attestation Library Index | Where the SOC 2 report and its sharing tier are listed, and where each release is logged |
P26-A08 Customer-Facing Security Overview Document | What customers may be told without the report |
P26-A09 Standard Security Commitments Schedule | What you commit to, and the limit of what a bridge letter may add |
P09-A03 Incident Response Plan | Decision rights and notification clocks for incidents, which these templates leave unchanged |
P09-A09 Incident Case & Action Log | The incident log that the letter's incident section is read against |
P20-A08 Control Deficiency & Remediation Tracker | Where exceptions found in your own checks are tracked to a retest |
[[Your confidentiality agreement; customer contracts; records policy]] | [[The terms the sharing steps check]] |
Definitions
Term | Meaning in these templates |
|---|---|
Bridge letter | A letter from your management that covers the interval after a report period ends. The CPA firm does not issue it, performs no procedures on the interval and gives no assurance over it. Market practice, not an AICPA document. |
Exception | A test result in which a control did not operate as described for a sampled occurrence. Some sources call these deviations. The auditor decides how one is described in the report. Management records the cause and its response, and also records those it finds itself in the period. |
Observation period | The period a Type 2 report covers, from its first day to its last. Also “the period”. |
Type 1 report | A report on the description and the design of the controls as of one date. |
Type 2 report | A report on the description and on the design and operating effectiveness of the controls throughout a period, with the auditor's tests and results. |
Attestation | An independent professional's written opinion on a subject that someone else (management) is responsible for. A SOC 2 report is an attestation. It is not a certificate and it is not a pass or a fail. |
Complementary user entity control (CUEC) | A complementary user entity control: a control the description says customers must operate for your controls to work as described. |
Service auditor (the CPA firm) | The licensed CPA firm that examines management's description and the controls, and issues the report. Also “the CPA firm” and “the auditor” in this pack. |
The EXAMPLE in one place: Acme
Item | EXAMPLE value |
|---|---|
The report | SOC 2 Type 2, Security, Availability, Confidentiality, period 1 January 2027 to 30 June 2027. Expected about 30 August 2027; two months is a house default and not a rule. |
The bridge window | 1 July 2027 to 30 September 2027: 92 days. About three months is market practice. |
The letter | Dated 20 September 2027, day 82: Bridge letter suitable |
The exception | A quarterly access review performed 20 days late (EK-2). Status at the date of the letter: Management response agreed. The retest follows the review due 15 October 2027. |
The next period | 1 July 2027 to 31 December 2027, the day after the first period ended (SR-16). Report expected about 29 February 2028. |
Guidance — delete before approval
Acme Corp (EXAMPLE) is a US software-as-a-service provider with about 400 staff, selling to businesses that ask for a SOC 2 report. It is not the organisation used in the earlier packs. Every value in the example is invented, and nothing in it says how your report, your dates or your customers will look. Replace the example, or delete the passages before anything leaves the company.
Adapting these templates
Small organisation
Guidance — delete before approval
In a small company one executive may sign the letter, approve the response and release the report. Keep the release record and the sharing log, because they show that the steps were taken. Let Legal, or an outside adviser, read the first letter and the first reply. Where one person plays several roles, write that in the record.
A one-page letter is enough. Keep all twelve sections, and write one or two sentences for each.
Regulated or customer-driven
Guidance — delete before approval
If a customer's contract sets a time within which it wants a letter or the report, put that date in your calendar and say in the reply whether you can meet it. If a customer's rules require a report whose period ended in a given time, tell them plainly what the next report's dates are.
If you are subject to a law with notification duties, those belong to the incident plan and the pack that holds it. These templates never alter them.
Outsourced providers
Guidance — delete before approval
If a provider's report is part of your evidence for a customer, share it only as its terms allow (P26 QG-14). If your letter refers to a change at a provider, say what changed for the customer and not what the provider tells you in confidence.
If a managed provider writes letters to customers for you, the signatory is still your executive, and the release record is still yours.
Delete this section before approval.
Framework references
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. Editions referenced: AICPA Trust Services Criteria (TSP section 100, 2017, with revised points of focus, 2022), by number and series title only; the AICPA description criteria (DC section 200, 2018, with revised implementation guidance, 2022), by topic only; ISO/IEC 27001:2022 and NIST CSF 2.0, by number and title; the Journal of Accountancy and the AICPA & CIMA pages named in the references; as published and read on 18 October 2026.
Framework | Reference | Supported by |
|---|---|---|
ISO/IEC 27001:2022 | Annex A 5.14 — Information transfer | Information transfer: the steps for sending a report, and a letter, to a customer by a controlled route |
NIST CSF 2.0 | GV.OC-02 — “Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered” | The needs of customers, as an external stakeholder, for assurance about your security, which the letters and replies address |
AICPA, SOC 2 | A bridge letter (or gap letter) is a letter from the service organisation's management that covers the interval after a report period ends. Advisory sources agree that the CPA firm performs no procedures on that interval and gives no assurance over it, and that about three months is the usual limit. The AICPA's SOC 2 guide (October 2022, read on 20 October 2026) does not use the term: it says (paragraphs 3.78 and 3.79) that a gap can fall between the periods of two Type 2 reports and that management may describe a significant change in the gap under ‘Other Information Provided by the Service Organization’. No AICPA definition or rule was found for a bridge letter. It is market practice, and customers decide whether they accept one | The whole of part 1: a letter from management that covers the interval after a period ends, with no assurance from the CPA firm |
AICPA, SOC 2 | The use of a SOC 2 report is restricted to specified parties with sufficient knowledge and understanding of the service organisation's system (Journal of Accountancy, February 2026, an AICPA publication). A SOC 3 report gives an opinion on operating effectiveness without the detailed tests and its use is not restricted (Trust Services Criteria introduction; Journal of Accountancy, 2016). Who may receive a SOC 2 report is for the CPA firm to state, and the report itself says it. A confidentiality agreement is common practice, not an AICPA rule | Part 3 and part 5: a SOC 2 report is generally restricted in use, and a SOC 3 report is the version for general use |
AICPA, SOC 2 | Complementary user entity controls (CUECs) are controls the description says user entities must operate for the service organisation's controls to meet the criteria; complementary subservice organisation controls (CSOCs) are the same for a carved-out subservice organisation. A user entity that does not operate its CUECs cannot rely on the report as it reads. Both terms are used in DC section 200 and the AICPA's SOC 2 guide (read on 20 October 2026); the text of the attestation standards was not read | The reminder, when a report is sent, that the report lists controls customers are assumed to operate |
AICPA, SOC 2 | SOC 2 CC2.3, Information and Communication | The series is about information and communication. The letters and replies in this document are part of what you tell customers about the system |
AICPA, SOC 2 | SOC 2 CC4.2, Monitoring Activities | The series is about monitoring activities. Management's responses record how deficiencies found in monitoring are followed up |
The Trust Services Criteria and the description criteria are published by the AICPA for CPAs who examine a service organisation. Nothing in law makes a SOC 2 report mandatory. A customer's contract, a procurement policy or an investor can ask for one, and the organisation chooses whether to commission an examination. The report is a CPA firm's opinion about the organisation's description and its controls. It is an attestation, not a certificate, and nobody is “SOC 2 certified” or “SOC 2 compliant” by holding one.
The observation period lengths, the three-month limit of a bridge letter, the order of the steps and the sample of questions for a CPA firm are market practice and house defaults. They are not rules of the AICPA, and the CPA firm and your customers decide what they accept.
ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that holding an ISO/IEC 27001 certificate equals, replaces or shortens a SOC 2 examination.
Criteria are cited by number and series title only. The statements of the criteria are in the Library. Citing a criterion does not say that any document, control or practice meets it.
A reference says what its source describes and which CISO Times document helps with that work. It does not say that a document from this pack meets a criterion, and it does not say that an organisation will receive an unqualified opinion.
This pack does not say which document, record or practice meets a criterion. Each reference says what its source describes and which CISO Times document helps with that work. Using a document does not by itself show that a criterion is met.