Vendor risk
Matching supplier evidence to what each supplier can reach.
Your SOC 2 report is about your controls, and one of them governs suppliers. The criteria leave the choice of evidence to you. So the useful question is how much proof a given supplier owes, judged by what it could damage if it failed or were breached.
Back to SOC 2 services01 · CC9.2
Start from the criterion you will be measured against
CC9.2 sets an outcome, not a list of documents.
Criterion CC9.2 in the 2017 Trust Services Criteria expects an organisation to assess and manage the risk that arrives through vendors and business partners. Its points of focus cover setting requirements for those relationships, assessing their risk, assigning accountability, checking performance, handling problems and ending the relationship cleanly. None of them names a SOC 2 report as the evidence you must collect.
Who is under test
The CPA firm examining you does not audit your suppliers. It samples your process: did each supplier receive the review your own policy promised, at the point the policy said it would?
02 · Exposure
Gauge exposure by what the supplier touches
Illustrative suppliers, graded by reach rather than by contract value.
| Supplier (illustrative) | What it can reach | If it fails | Proportionate evidence |
|---|---|---|---|
| Cloud hosting provider | All production systems and customer data | The service stops | An independent audit report (SOC 2 Type 2, or ISO/IEC 27001 with a matching scope), read every year |
| Customer-support ticketing tool | Customer names, messages, attachments | Support slows; data may leak | An audit report where one exists, otherwise a dated questionnaire and security clauses |
| Source-code host | Your code and deployment secrets | Releases halt; an attacker gains a foothold | An audit report plus your own review of its settings, such as MFA and branch protection |
| Diagramming tool | Internal sketches, no customer data | Minor inconvenience | A register entry with an owner |
| Office cleaning contractor | Floor space, no system access | Nothing in the service | A register entry; building rules cover the rest |
Grade each supplier by its worst exposure, not its typical one. A tool that holds no customer data but stores production credentials belongs beside the hosting provider, not beside the diagramming tool.
03 · Evidence ladder
An evidence ladder, strongest rung first
Step down only as far as the exposure allows.
- Rung 1SOC 2 Type 2An independent opinion on controls operating over a period. Check the period, the boundary and the exceptions before you file it.
- Rung 2ISO/IEC 27001 certificateIssued by a certification body. Confirm the scope statement includes the service you use and that the body is accredited.
- Rung 3SOC 2 Type 1Design at a single date. Reasonable for a younger supplier, with a note to ask for the Type 2 later.
- Rung 4Questionnaire with test summarySelf-reported answers, made stronger by a recent independent penetration test summary and named contacts.
- Rung 5Register entry onlyName, owner, purpose and data touched. Enough for suppliers with no reach into your system.
When a supplier's report arrives, record five things
- Period end. How recent is the evidence, and does the supplier offer a bridge letter for the months since?
- Boundary. Is the product you buy inside the system it describes?
- Exceptions. Do any failures touch controls you depend on?
- Their CUECs. Which controls does the supplier expect you to run, and are you running them?
- Their carve-outs. Which of its own providers are excluded, and do you need those reports too?
04 · No report
A key supplier with no independent report
Shrink its reach, then write down why the remaining risk is acceptable.
- Cut what it can reach: send fewer fields, mask what it does not need, and scope its credentials to the minimum.
- Ask for what does exist: a recent independent penetration test, architecture notes, references from similar customers.
- Put protection in the contract: breach notice, a right to audit or to receive evidence, and deletion on exit.
- Record a risk acceptance signed by an accountable manager, stating when you will look again.
- Check in more often than you do with suppliers that hold reports.
Some supplier duties come from law, not from SOC 2. GDPR Article 28 lets a controller use only processors that give sufficient guarantees, under a binding contract. HIPAA expects a business associate agreement before a vendor handles protected health information. India's DPDP Act allows a Data Fiduciary to engage a Data Processor only under a valid contract. Each of these fixes contract terms; none prescribes a particular audit report.
05 · Audit sampling
Where supplier controls fail in testing
The examining firm traces suppliers from first contract to exit.
- A register that drifts from reality. Finance pays a supplier the register never lists. Auditors can compare the two.
- A review dated after access. The supplier held credentials weeks before its assessment was recorded.
- Yearly reviews that slipped. The policy promises an annual check; the sample shows eighteen months between them.
- Carved-out providers left unread. Your report names a hosting provider as carved out, yet nobody obtained its report during the period.
- Access that outlived the contract. A former supplier's accounts still sign in.
Sources: AICPA TSP section 100, 2017 Trust Services Criteria with revised points of focus (2022), criterion CC9.2; AICPA SOC 2 guide; Regulation (EU) 2016/679 (GDPR), Article 28; 45 CFR 164.502(e) and 164.504(e); Digital Personal Data Protection Act, 2023, section 8.
Supplier evidence, answered
Do we have to read every supplier's full report?
Only for suppliers with real reach into your system.
For suppliers at the top of your exposure scale, yes: read the opinion, the boundary, the exceptions and the CUECs, and keep a short dated note of what you found. Lower down, a register entry or questionnaire is proportionate.
Our hosting provider is carved out of our report. What does the auditor expect?
Proof that you monitored it during the period.
A carved-out subservice organisation sits outside your report's testing, so the auditor looks for evidence that you kept an eye on it. Reading its latest report, noting its exceptions, and confirming you run the controls it expects of its customers covers most of that.
Can an ISO/IEC 27001 certificate stand in for a SOC 2?
For many suppliers, yes, after a scope check.
The certificate shows a certification body audited the supplier's management system. It tells you less about individual control tests than a Type 2 report, which is acceptable for most suppliers. Read the scope line: a certificate covering only a head office says nothing about the cloud service you buy.
Must suppliers be reviewed before we sign with them?
Your own policy decides, and the auditor holds you to it.
The criteria do not fix the moment. Most policies say before data or access is granted, because that is when the review can still change the decision. Whatever you write, the dates in your evidence must match it.
Make vendor management easy to evidence.
A SOC 2 readiness assessment builds a tiered vendor register your auditor can sample cleanly.