Buyer's scorecard
Is this vendor's SOC 2 any good? Ten checks, rated red, amber or green.
Having a SOC 2 and having a useful SOC 2 are different things. A report can be genuine and still cover the wrong product, an old period, or a system so vaguely described that it tells you nothing. This is our own rubric: ten checks, each with what good and thin look like, and a simple red / amber / green reading.
Back to SOC 2 services01 · How to use it
How the scorecard works
Ten checks, three colours, one decision.
Work through the report with the scorecard beside it. Each check gets green (supports reliance), amber (usable with follow-up questions) or red (does not support reliance on its own for this check). The colours are a reading aid, not a pass mark: a single red on scope matters more than three ambers on detail.
- Checks
- 10
- Each answerable from the report itself.
- Readings
- 3
- Green, amber, red.
- Decision
- 1
- Rely, rely with conditions, or ask for more.
Read the opinion and scope first. If either is red, the rest of the report can't rescue it.
02 · Checks 1 to 5
Checks 1 to 5: what the report covers
Scope, age, type, categories and opinion decide whether the report is about you at all.
| Check | Green | Amber | Red |
|---|---|---|---|
| 1. Scope match | The product and environment you buy are named in the system description | Covered, but bundled with others and hard to separate | Your product, region or deployment is not in scope |
| 2. Period and age | Period ended recently, with a bridge letter for the gap | Gap is growing and no bridge letter yet | Period ended long ago, nothing since |
| 3. Type | Type 2 over a meaningful period | Type 2 over a short first period | Type 1 only, where you need evidence of operation |
| 4. Categories | Includes every category your use depends on | Security only, but your need is mainly Security | Missing a category you rely on, such as Availability for an uptime-critical service |
| 5. Opinion | Unmodified | Unmodified with an emphasis paragraph worth reading | Qualified, adverse or a disclaimer |
On age, the report's period end date is what counts, not the date it was signed. Buyers set their own tolerance; the common practice is to expect a fresh period every year and a bridge letter from management for the months in between.
03 · Checks 6 to 10
Checks 6 to 10: how much the report actually tells you
Exceptions, vendors, your own duties, detail and the signer decide how far you can rely.
| Check | Green | Amber | Red |
|---|---|---|---|
| 6. Exceptions and responses | None, or few, each with a specific management response | Exceptions in areas you care about, with credible remediation | Repeated exceptions in access or change, or no response |
| 7. Subservice treatment | Key vendors named, method stated, monitoring of their reports described | Vendors named but monitoring thin | Critical vendors absent, or carve-out with no monitoring control |
| 8. CUEC burden | A short, specific list you already meet | A long list that needs work on your side | CUECs that move the vendor's core duties onto you |
| 9. Description specificity | Names real tools, data flows, people and boundaries | Accurate but generic in places | Could describe any company; no real boundaries |
| 10. Auditor credibility | Licensed CPA firm, verifiable permit and peer review | Firm unfamiliar to you, but checks out | Firm can't be found in public records, or the report calls itself a certificate |
Reading exceptions fairly
An exception is a finding about operation, not a verdict on the vendor. One missed access review in a large population, with a clear response, is often amber. The same control failing every quarter is red, because it suggests the vendor's monitoring didn't notice.
04 · Worked example
A worked example (illustrative)
A hypothetical vendor, scored row by row.
Illustrative only. A buyer is reviewing a hypothetical document-signing API that will hold signed contracts. The vendor shares a Type 2 report covering Security and Availability.
| Check | Finding | Reading |
|---|---|---|
| 1. Scope | API and EU region in scope; the buyer uses the EU region | Green |
| 2. Age | Period ended some months ago; bridge letter supplied | Green |
| 3. Type | Type 2 | Green |
| 4. Categories | No Confidentiality, though contracts are confidential | Amber |
| 5. Opinion | Unmodified | Green |
| 6. Exceptions | Two late terminations, management response specific | Amber |
| 7. Subservice | Cloud host carved out; review of its report described | Green |
| 8. CUECs | Customer must manage its own user roles and API keys | Green |
| 9. Description | Names tools and data flows clearly | Green |
| 10. Auditor | Firm permit and peer review found | Green |
The decision in this example
Rely, with conditions: ask how confidential data is classified and disposed of, since the category is missing, and confirm that the termination fix has been operating since the period ended.
05 · After scoring
Turning the colours into a decision
Reds become questions, ambers become conditions, greens become file notes.
Any red
- Ask the vendor directly about that check
- Request other evidence, such as a newer report or a targeted questionnaire
- Escalate if the red is scope or opinion
Ambers only
- Rely with written conditions
- Track the follow-up at the next review
- Check your CUEC duties are assigned internally
All green
- Record the review and the period covered
- Diary the next report date
- Keep the bridge letter on file
Your own CUEC duties apply whatever the colours. A green report doesn't do your side of the work.
Sources: AICPA guide SOC 2 Reporting on an Examination of Controls at a Service Organization; AICPA DC section 200 description criteria; TSP section 100 Trust Services Criteria (2017, revised points of focus); AT-C section 205. The scorecard and its readings are Auditify's own.
More about judging vendor reports
Does a single red mean we can't use the vendor?
No. It means that check needs other evidence.
A red says the report alone doesn't support reliance for that check. The vendor may answer it another way, with a newer report, a targeted questionnaire or a contractual commitment.
Should we score every vendor this way?
Score in proportion to the vendor's reach.
Use the full scorecard for vendors that hold or process sensitive data. For low-reach tools, checks 1, 2, 5 and 10 are often enough.
Can we share our scorecard with the vendor?
Yes, and it often speeds things up.
Sending the specific ambers and reds as questions gets clearer answers than a generic questionnaire, and shows the vendor what its next report should address.
What if the vendor only has a SOC 3?
Score what you can; most checks will be amber or red.
A SOC 3 carries the opinion but not the detailed tests, exceptions or CUECs. It supports checks 1, 2, 5 and 10 at best; ask whether the vendor will share the SOC 2 under NDA.
Review vendor reports with confidence.
We help your team triage vendor reports and turn the gaps into precise follow-up questions.