Glossary · SOC and attestation
A CSOC records what your report quietly counts on a vendor to do.
Controls that a service organization assumes its carved-out subservice organizations operate, without which its own controls would not meet the stated objectives or criteria.
Back to the glossary01 · In plain words
In plain words
Controls that a service organization assumes its carved-out subservice organizations operate, without which its own controls would not meet the stated objectives or criteria.
When you carve a vendor out of your SOC report, part of your system still depends on that vendor. Complementary subservice organization controls, or CSOCs, are the vendor-side controls your report assumes are in place. Your report lists them so readers know what to check in the vendor's own report.
Spelled out: Complementary subservice organization controls.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
CSOCs tell a reader where your assurance stops and the vendor's must take over. A buyer can only close that gap if the CSOCs are specific enough to match against the vendor's report. Vague lines such as the vendor maintains appropriate security are of little use. CSOCs also bind you: if your auditor finds you never reviewed whether the vendor actually runs them, that monitoring gap can turn into an exception in your own report.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- Section 3, the system description
- A list or table of CSOCs, usually grouped by subservice organization.
- The auditor's opinion
- A paragraph noting that the controls are suitably designed only if the CSOCs operate as assumed.
- Vendor review records
- Your evidence that you compared each vendor's report with the CSOCs you rely on.
- A customer's vendor-risk review
- Where a security analyst looks for the vendor's report to cover your CSOCs.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a payments gateway that relies on a tokenisation vendor
A payments gateway sends card numbers to a specialist tokenisation vendor and stores only tokens. It carves the vendor out. Its CSOCs say the vendor restricts access to the token vault and its encryption keys to authorised personnel, logs and reviews that access, and notifies the gateway of security incidents affecting its data. Each year the gateway's risk team reads the vendor's report, ticks each CSOC against a tested control, and records one that the vendor's report does not cover, with the follow-up.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- CUEC
- CUECs are controls your customers must run. CSOCs are controls your vendors must run. Both complement your controls, from opposite sides of the supply chain.
- Your vendor management controls
- Your own controls for choosing and monitoring vendors are tested in your report. CSOCs are the vendor's controls, which your auditor does not test.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- For each carved-out vendor, write the controls you depend on in the vendor's terms, not yours.
- Check that each CSOC can be matched to a tested control in the vendor's latest report.
- Record the review, including CSOCs the vendor's report does not cover and what you did about it.
- GuideComplementary controls: what customers and vendors owe the systemCUECs and CSOCs, written so they can actually be checked.
- GuideSubservice organizations: vendors inside your reportWho counts, how they're monitored, and what the report must say.
- GuideHosting on a SOC 2 cloud: what you inheritWhat a provider's report covers, and the controls that stay yours.
Sources: AICPA SSAE 18; AT-C section 320; AICPA guide on SOC 2 reporting; DC 200 description criteria.
Questions about CSOC
Do CSOCs exist under the inclusive method?
No, not for that vendor.
Under the inclusive method the vendor's relevant controls are inside the description and tested, so there is nothing left to assume. CSOCs arise only for subservice organizations that are carved out.
When did CSOCs become a required part of SOC reports?
With SSAE 18.
The AICPA's SSAE 18 made identification of complementary subservice organization controls an explicit part of the description when the carve-out method is used. Earlier reports often mentioned vendors less precisely.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.