Your vendors can end up inside your SOC report as subservice organizations.

Most service providers run on other providers: a cloud host, a payments processor, an outsourced support desk. When one of those vendors performs work that your controls depend on, it is a subservice organization. Your report has to say so, and has to say how it treats that vendor.

A customer reading your report wants to know whether the whole chain behind your service is controlled, not only the part you run. If a vendor holds production data or runs part of the process, its failures become yours. The report must either present the vendor by the carve-out method, leaving its controls out but naming the ones you expect it to run, or by the inclusive method, testing them inside your examination. Either way, the examiner will want to see that you monitor the vendor, usually by reading its own SOC report each year.

Section 3 of the report

The system description lists each subservice organization, what it does and how it is presented.

The CSOC table

The controls you expect each carved-out vendor to operate, paired with the criteria they support.

Your vendor management file

Annual review of each vendor's SOC report, exceptions noted and follow-up recorded.

The scoping call with the CPA firm

Where you agree which vendors are in the chain and which are only suppliers of tools.

User entity

The customer that uses your service. A subservice organization sits behind you, not in front.

Any vendor

Only vendors whose controls the criteria or objectives depend on qualify. A note-taking app usually does not.

• List every vendor that stores, processes or runs part of the in-scope system, and why.
• Decide with your examiner whether each is presented by carve-out or inclusive method.
• Write the CSOCs you expect from each carved-out vendor in plain, checkable terms.
• Collect each vendor's current SOC report and record your review of it.

• GuideSubservice organizations: vendors inside your reportWho counts, how they're monitored, and what the report must say.
• GuideCarve-out or inclusive: how vendors appear in your reportTwo ways to present a vendor, and what each does to your report.
• GuideSubservice organizations in a SOC 1Carve-out or inclusive for the vendors behind your service.

Sources: AICPA AT-C section 320; AICPA Guide, SOC 2 Reporting on an Examination of Controls at a Service Organization; AICPA DC 200, 2018 Description Criteria.