The AICPA Trust Services Criteria in force today, the 2017 criteria with revised points of focus from 2022, include one short criterion about vendors. CC9.2 reads: "The entity assesses and manages risks associated with vendors and business partners." A CPA firm's guidance on subservice organizations, published on 25 June 2025, says that when you carve a vendor out of your report you are still responsible for understanding it and managing the risk it creates, and the same firm lists unmonitored subservice organizations among common causes of SOC audit failure.
What's affected
Any company whose product depends on vendors that touch customer data or run controls on your behalf. For a typical SaaS business that means the cloud host, the identity provider, the code host, the support tool, the payroll and HR system, and the email provider.
Two terms from the SOC 2 vocabulary:
- Subservice organization. A vendor whose services are part of your system and whose controls are needed to meet your criteria. Your cloud host is the usual example.
- Complementary user entity controls (CUECs). Controls a vendor expects you to run. Their SOC report lists them, and you are responsible for them.
Your own report treats each subservice organization in one of two ways.
| Method | What the report does | What it means for you |
|---|---|---|
| Carve-out | Excludes the vendor's controls. Describes the service and the complementary subservice organization controls (CSOCs) you assume the vendor performs | Simpler. You must still monitor the vendor |
| Inclusive | Includes the vendor's controls and tests them as part of your system | Heavier. The vendor has to agree to be tested, and sign a management assertion and representation letter |
Linford and Company advises that carve-out is usually the safer path unless you can get detailed control information and have the standing to ask for it. It also notes that a major cloud provider is typically carved out of a SaaS company's report. Citing AICPA guidance, it states that service organization management is responsible for designing, implementing and operating controls to monitor the effectiveness of controls at the subservice organization, whichever method is used. For SOC 2, that is where CC9.2 applies.
How to check if you're exposed
- List every vendor that stores, processes or can reach customer data, and every vendor that runs a control you rely on.
- For each, find the most recent independent report and its period. Is there one? Is it current? Does it cover the service you actually use?
- For each report you have, can you point to a dated note showing someone read it?
- Can you say which CUECs apply to you, and which of your controls meets each one?
What to do now
- Build a vendor register with these columns: vendor, what it does, data it touches, criticality, report type and period, last review date, reviewer, CUECs mapped, exceptions noted, next review date.
- Read each critical vendor's report with five questions, which match the checklist in the CPA firm's guidance. Does it cover the services you use? Was the opinion unmodified, or did the auditor find controls not designed or not operating effectively? Are the CSOCs your report assumes actually covered in the vendor's report? Are there deficiencies the vendor's management did not adequately explain? Which CUECs do you own?
- Write a one page note per vendor: report attributes, conclusion, CSOC coverage, CUEC mapping, and mitigations for any gap. The firm recommends documenting what was done, the conclusions and the artifacts.
- Cover the CC9.2 points of focus in your process: set requirements at onboarding (scope, roles, compliance requirements, service levels), assess risk periodically, assign an owner, define communication and exception handling, assess performance, address issues, and define how relationships end.
- For vendors with no report, use a questionnaire and contract terms, and record the decision.
How to avoid this trap
- Do not file a PDF and call it monitoring. A report you did not read could hide a qualified opinion, and the CPA firm notes that if you have no controls that meet the CUECs, the vendor's controls may not make up for your weakness.
- Do not wait for the audit to build the register. Reports have periods, and an expired report is a gap.
- Do not forget the vendors that were added casually. A tool connected with a quick sign-in is still a vendor.
- Do not choose the inclusive method to look thorough. It brings the vendor's controls into your testing and your timeline.
Why it matters
Auditors accept that you cannot test a cloud provider. They do not accept that you ignored it. CC9.2 moves the question from "is the vendor secure" to "what did you do to find out." The answer is a register, a dated review and a note that maps vendor expectations to your controls.
There is a second use. The same register answers the vendor section of enterprise security questionnaires, which asks the same things your auditor will.
Try it yourself
Pick your three most critical vendors. For each, find the latest report, write down the period and the opinion, and find one CUEC. If you cannot find a report for one of them, that vendor goes at the top of your list.
Click through it at your own pace, or open it full screen.
Quick check
If your cloud provider is carved out of your SOC 2 report, can you ignore it?
No. Under either method, management is responsible for monitoring the controls at the subservice organization. For SOC 2 this is typically evidenced under CC9.2.
What is a CUEC?
A complementary user entity control: a control the vendor's report says the customer must operate. You need to know which ones apply and show that your own controls meet them.
