A CPA firm's guidance on subservice organizations, published on 25 June 2025, says that when a vendor is carved out of your SOC 2 report you are still responsible for understanding it and managing the risk it creates. You cannot do that for vendors you have forgotten. Most startups list ten vendors from memory and have forty.
What's affected
Every vendor that stores, processes or can reach customer data, and every vendor that runs a control you rely on. The CC9 criteria group covers vendor due diligence, including reviewing vendors' SOC reports, per a CPA firm's October 2026 guide.
What to do now
- Identity provider export. List every app connected to single sign on. Export it with user counts.
- Billing export. Pull 12 months of card and accounts payable lines. Reduce to unique payees:
cut -d, -f2 card_export.csv | sort | uniq -c | sort -rn | head -80
- OAuth and integration grants. In your code host, cloud console and workspace suite, export third party app grants. These are the vendors nobody bought through procurement.
- Merge the three lists into one sheet. Add columns: what it does, data it touches, criticality, owner, report type and period, last review date, next review date.
- Mark vendors that touch customer data, then read the independent report for each critical one and write a dated note. The CPA firm's checklist asks whether the report covers the services you use, whether the opinion was unmodified, and which complementary user entity controls you own.
- Rerun the three exports every quarter and diff against the register.
Why it matters
An auditor samples from the register. A vendor that is missing from it but present in your billing data is a gap between your description and reality. The three exports take an hour and make the register match the evidence.
Click through it at your own pace, or open it full screen.
Quick check
Which three data sources find vendors that memory misses?
Single sign on app lists, billing or card statements, and third party OAuth or integration grants.
