SaaS companies are built on other companies’ services. Cloud infrastructure, databases, payment processing, email delivery, customer support tools, and monitoring platforms all touch your product and, often, your customers’ data. If you are pursuing or maintaining SOC 2, your auditor will want to see how you manage the risk those vendors create.
This guide explains what SOC 2 requires for vendor management, what auditors look for as evidence, and how to review a vendor’s SOC 2 report the right way.
What Does SOC 2 Require for Vendor Management?
SOC 2 vendor management requirements come primarily from the Common Criteria in the AICPA Trust Services Criteria. The key criterion is CC9.2, which states that the entity assesses and manages risks associated with vendors and business partners.
SOC 2 doesn’t prescribe a specific process, but auditors expect a repeatable vendor risk management lifecycle that covers:
- A current inventory of vendors and the data or systems each can access
- Risk assessment and tiering before a vendor is approved
- Due diligence proportionate to each vendor’s risk
- Contracts that define security and confidentiality commitments
- Ongoing monitoring throughout the audit period
- Offboarding that removes access and addresses data return or destruction
Vendor oversight also connects to other criteria, including risk assessment (CC3) and logical access controls (CC6), so weaknesses in vendor management can surface as findings elsewhere in your report.
What SOC 2 Auditors Look For
For a SOC 2 Type II audit, auditors test whether your controls operated consistently over the entire review period, not just whether a policy exists. Expect them to sample vendors and ask for:
- Your vendor inventory with risk tier, data classification, and internal owner for each vendor
- Evidence of due diligence performed before onboarding, such as reviewed SOC reports or completed questionnaires
- Documented review of vendor SOC reports, including how you addressed exceptions
- Complementary user entity control (CUEC) mapping showing that you operate the controls your vendors rely on you to perform
- Monitoring records proving that reviews happened on the schedule your policy defines
- Offboarding evidence for vendors that were terminated during the period
How to Review a Vendor’s SOC 2 Report
Collecting a vendor’s SOC 2 report is easy. Reviewing it properly is where many SaaS teams fall short. For each critical vendor, check:
- Report type. A Type II report tests controls over a period of time and provides much stronger assurance than a Type I, which only evaluates control design at a single point in time.
- Audit period. Confirm the period is recent. If there is a gap between the end of the period and today, request a bridge letter.
- Scope. Make sure the services and systems you actually use are covered, along with the Trust Services Criteria that matter to you.
- Auditor’s opinion. A qualified opinion signals significant control problems that need follow-up.
- Exceptions. Read the testing results. Assess whether any exceptions affect your data and how management responded.
- Complementary user entity controls. These are controls the vendor assumes you will perform, such as enforcing MFA or reviewing user access. They are your responsibility, and auditors will check them.
- Subservice organizations. Identify your vendor’s own critical vendors, such as its cloud provider, and whether they are carved out of the report. If they are, you may need their reports too.
Document each review. An unreviewed SOC report in a shared folder is not evidence of vendor risk management.
How to Tier SaaS Vendors by Risk
- Critical: vendors that host production systems, store customer data, or would halt service if they failed, such as your cloud provider, database service, or payment processor. These need full SOC report review, CUEC mapping, and annual reassessment.
- Moderate: vendors with limited access to sensitive data, such as support desk or CRM tools. A questionnaire and annual lightweight review are usually enough.
- Low: vendors with no access to customer data or production systems. Keep them in the inventory and review them at renewal.
Your Customers See You as Their Vendor
There is a sales benefit to getting this right. Your enterprise customers run their own vendor risk programs, and your company is on their list. Security questionnaires increasingly ask how you manage fourth parties, meaning your vendors. A mature, documented third-party risk management program helps you answer confidently, pass customer reviews faster, and close deals sooner.
Common SOC 2 Vendor Management Mistakes
- Onboarding vendors through a credit card without any security review
- Storing vendor SOC reports without reviewing or documenting them
- Ignoring CUECs until the auditor raises them
- Letting annual reviews lapse partway through the audit period
- Failing to revoke access when a vendor relationship ends
Frequently Asked Questions About SOC 2 Vendor Management
What is CC9.2 in SOC 2?
CC9.2 is the Common Criteria requirement that an organization assesses and manages risks associated with vendors and business partners. It is the primary SOC 2 criterion for third-party risk management.
Do all of my vendors need a SOC 2 report?
No. SOC 2 expects risk-based oversight. Critical vendors should provide a SOC 2 Type II report or equivalent, such as ISO 27001 certification, while lower-risk vendors can be assessed through questionnaires or basic review.
What is a bridge letter?
A bridge letter, also called a gap letter, is a statement from a vendor’s management covering the period between the end of its last SOC report and the present. It confirms that no material changes to controls have occurred.
What happens if a vendor doesn’t have a SOC 2 report?
You can use alternative assurance, such as a detailed security questionnaire, policy review, penetration test summary, or an independent assessment. Document your risk decision and any compensating controls.
How often should SaaS vendors be reviewed for SOC 2?
Critical vendors are typically reviewed annually, when their new SOC report is released. Review frequency for other vendors should follow the tiers defined in your vendor management policy.
Make Vendor Management Audit-Ready
Continuiti Solutions helps SaaS companies build SOC 2-ready vendor programs without pulling engineers off the roadmap. Our analysts review vendor SOC reports, map CUECs, track exceptions, and keep your evidence organized in our GRC Pro portal at no additional cost. Explore our full-service vendor management or contact us to get started.
New to vendor risk? Start with our guide to third-party risk management for small and mid-sized businesses.
