If you host on a public cloud, the provider's own audit report covers its facilities and underlying services, usually through the carve out method. Everything you configure on top, including identity, networks, storage settings, logging and your application, remains yours and needs your evidence.
The split
Think in layers. The provider runs the physical data centers, hardware and the base services. You run the accounts, the identity setup, the network rules, the data stores and the code.
In a SOC 2 report written with the carve out method, the provider's controls are left out of testing. The report instead lists the controls you rely on them to operate, and the auditor expects you to review the provider's own report. Under the inclusive method the provider's controls are part of your description and testing, which is rarer.
What you review about the provider
- Get the provider's current audit report through its normal process.
- Check the period covered and any exceptions that touch services you use.
- Read the complementary controls they say customers must operate.
- Record your review and the date. This is evidence for vendor management, CC9.2.
What stays with you
Physical access to a cloud data center is the provider's job. Almost everything else is shared or yours.
- Identity and access: who can sign in, roles, MFA, key rotation. See logical access.
- Network configuration: security groups, public exposure, private endpoints.
- Data protection: encryption settings, key management, bucket policies.
- Logging and monitoring: turn on audit logs, send them somewhere, set alerts. See audit logging.
- Backups and recovery: set them up and test them.
- Change management: infrastructure as code reviews and deployments.
- Vulnerability management: images, hosts, dependencies and your own code.
Multi cloud and many accounts
Map each account to a purpose, an owner and an environment. Production, staging and development should not share administrative roles. Keep an inventory. Auditors will ask which accounts are in scope.
Evidence to prepare
- Account list and ownership.
- Identity provider and cloud role assignments with review records.
- Configuration exports showing encryption and logging.
- The provider's report and your review note.
- Alert rules and a sample alert with the response.
Common mistakes
- Citing the provider's report as if it covered your configuration.
- Forgetting a legacy account.
- Logs enabled but not retained or not monitored.
- No record that you reviewed the provider's report.
Safeguard's asset discovery and compliance and evidence automation can help build the inventory and keep dated records. Check which connectors apply to your stack before relying on them.
Quick check
Does using a compliant cloud make us compliant?
No. The provider's report covers its part. Your configuration and operations must meet the criteria on their own evidence.
Do we need the provider's report every year?
Review the current one each cycle and keep a record. Reports cover periods, so older ones go stale.
Last reviewed: 19 October 2026.
