A SOC 2 gap period is the stretch of time between the end of your last Type 2 reporting period and today, or between that period and the start of the next. A bridge letter is a statement from your management, not the auditor, saying controls have not materially changed since the period ended.
Why do gaps appear?
A Type 2 report covers a specified period and includes the auditor's tests of operating effectiveness across it. When the period ends, the report goes quiet about what happens next. Audit fieldwork and report issuance take time, so by the time a buyer reads your report, the period may have ended months ago. The buyer's question is fair: what has happened since?
The AICPA's glossary in the criteria document describes subsequent events as events or transactions that occur after the specified period addressed by the description. That is the idea behind a bridge letter, though the AICPA criteria do not define a bridge letter as a deliverable.
What is a bridge letter, exactly?
It is a short letter signed by an executive or the compliance owner, addressed to customers, that covers the time from the end of the last report period to the date of the letter. It is common practice, not a requirement of the Trust Services Criteria, and the format varies. Because your management writes it, the auditor has not tested anything in it.
A useful letter states:
- the report name and period covered
- the date range the letter covers
- whether management is aware of any significant changes to the system or controls
- whether management is aware of any security incidents or control failures affecting the criteria in the report
- a plain statement that the letter is management's assertion and not an audit opinion
- who to contact
What should you not put in it?
Do not promise things you cannot back. Do not say "no incidents" if you have not checked your records. Do not describe controls as tested after the period ended. Do not imply the auditor reviewed the letter unless they did. Some firms offer to read a draft or have their own guidance, so ask your auditor before you send the first one. Keep a dated copy and the evidence you used to make each statement.
How do you back the statements?
Before signing, run a short checklist: review incident records since the period end, list system changes, check that scheduled controls ran in that window, such as the access review or the vulnerability review, and check for leavers who kept access. Attach the notes to a ticket. If something changed, say so plainly and describe it; buyers trust a letter that discloses a change more than one that says nothing ever happens.
How do you shrink the gap?
Gaps close when periods run back to back. Ask your auditor whether the next period can begin the day after the last one ends. Then keep controls running during fieldwork, because the next period is already underway. Keep a rolling evidence habit so you can issue a letter in an hour, not a week. Also consider your report timing: finishing fieldwork sooner reduces how stale the report looks to a buyer.
What if there is a real gap with no coverage?
If a period lapsed, say so. A buyer may accept a bridge letter for a short gap, ask for a new Type 2, or ask for a Type 1 style readiness description while a new period runs. Do not paper over it. Offer the evidence you have, and explain the date the next period starts and when the next report is expected.
What to do
- Agree back to back reporting periods with your auditor.
- Write a bridge letter template that lawyers and the compliance owner approve once.
- Set the evidence checklist behind it: incidents, changes, scheduled controls, access.
- Name who signs and keep dated copies.
- Share only what you can support with records.
- Ask your auditor whether they will review wording.
- Keep a customer facing note for any real gap, with the next period dates.
Quick check
Is a bridge letter part of the SOC 2 report?
No. It is a separate management statement and the auditor has not tested it.
Does a Type 1 report cover a gap?
No. Type 1 describes the design of controls at a point in time and gives no opinion on operating effectiveness.
How Safeguard helps automate this
A bridge letter is as honest as your records. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs between audits, which means you can check what changed since the period ended without a scramble. Technical evidence comes from your real code and dependencies through scans, SBOMs and reachability. The agent can open tested fix pull requests, but it is off by default, every category starts on Manual, and you choose what runs automatically. Safeguard helps prepare and keep evidence ready; it does not replace the auditor or issue reports. Book a call.
Sources
- AICPA, 2017 Trust Services Criteria with revised points of focus (2022), glossary entry for subsequent events: AICPA Trust Services Criteria
Last reviewed: 18 October 2026.
