Receiving a SOC 2 report is not the same as reviewing it. Read the right sections and you will know what the vendor really assures — and what remains your job.
A Type I report describes controls at a point in time. A Type II report tests whether those controls operated effectively over a period, usually six to twelve months. For critical vendors, ask for Type II.
| Section | What to check |
|---|---|
| Auditor’s opinion | Unqualified, qualified or adverse? |
| System description | Does the scope include your service, locations and systems? |
| Trust services criteria | Security is always included; are Availability, Confidentiality, Processing Integrity or Privacy relevant to you? |
| Period | Is it recent? Is there a gap to today? |
| Exceptions | What failed, how often, and the response |
| Subservice organizations | Carved out or included? Do you need their reports too? |
| CUECs | Which controls must you operate? |
The report assumes customers perform certain controls — for example, managing their own user access or reviewing logs. If you do not, the assurance does not hold for you. Record each CUEC and the internal owner.
When the report period ended months ago, ask for a bridge (gap) letter in which management states that no material changes occurred since. It is management’s assertion, not auditor assurance.
Record the review result against the vendor: period, opinion, exceptions, CUECs and follow-up actions. Track the report’s expiry so a new one is requested automatically.
Each relevant exception should become an issue with the vendor: ask what caused it, what was fixed and when, and whether the next report will show the control operating. Track the issue to closure and link it to the vendor’s residual risk.
Smaller vendors often have no SOC 2 or ISO 27001 certification. Use a proportionate questionnaire with targeted evidence requests, ask for a penetration test summary and key policies, and for critical services agree audit rights in the contract. Revisit the vendor’s assurance position annually — many obtain certification as they grow.
NAZZTEC AI TPRM automates this end to end — with AI assistance, segregation of duties, analytics and signed reports — and is available as SaaS, in your private cloud or on-premises. Our consultants design and run the process alongside it through our Audit & Assessment services.
Next step: request a demo of NAZZTEC AI TPRM or read more on the product page.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
Spreadsheets and e-mailed questionnaires cannot keep up with hundreds of vendors. Here is what AI-driven TPRM software must deliver — and where human judgement must stay in charge.
A 300-question spreadsheet sent to every supplier produces fatigue, not assurance. Design questionnaires by tier, ask for evidence, and review answers consistently.
Not every server deserves the same protection. Rating confidentiality, integrity and availability tells you which assets matter most — and why.
Tell us what you are working on. A senior NAZZTEC consultant will come back within one business day with a practical view.
We respond to every enquiry within one business day.