Under SOC 2 criterion CC9.2 you must assess and manage risks tied to vendors and business partners, and a Type 2 auditor will want proof it happened during the whole report period. The workable pattern is a yearly cycle: keep an inventory, tier by risk, collect each vendor's assurance report, review it, record gaps and sign off.
What does CC9.2 expect?
CC9.2 is one sentence: the entity assesses and manages risks associated with vendors and business partners. The points of focus around it name six habits. Set requirements for vendor engagements, identify vulnerabilities arising from vendors, inventory and tier vendors and assess their risk, assign responsibility, set communication protocols, and handle exceptions.
Type 2 matters because the report covers a period and includes tests of operating effectiveness. A review done once in the last week of the period is weak evidence. Spread the work so each quarter has dated artefacts.
What does the yearly cycle look like?
Quarter 1: inventory and tiers
- Pull a vendor list from finance (everything paid), the identity provider (everything with single sign on) and engineering (everything in the build and runtime). Merge them. Differences are shadow vendors.
- Tier each vendor, for example critical, important, standard. Criteria: touches production, holds customer data, can interrupt service, difficulty of replacing.
- Assign an owner for each vendor, a person, not a team.
Quarter 2: collect assurance
- For critical and important vendors, request the current SOC 2 report, ISO 27001 certificate with scope statement, penetration test summary or a completed questionnaire.
- Ask for a bridge letter when the report period ended months ago.
- Record request date and receipt date.
Quarter 3: review and decide
- Review each report against the checklist below.
- Log gaps, compensating controls you operate yourself, and a decision: accept, remediate with the vendor, or replace.
- Management signs off on high risk acceptances.
Quarter 4: close and prepare
- Confirm actions closed. Update the inventory for adds and exits.
- Re-tier anything that changed. Offboard unused vendors, revoke their access and confirm data deletion.
- Set next year's calendar.
Run a light check every quarter for new vendors: nobody should adopt a tool that touches customer data without a tier assigned.
How do you read a vendor's SOC 2 report?
Do not file it. Read these parts.
- Report type and period. Type 2, and does the period cover recent months? A Type 1 describes design at a point in time, with no opinion on operating effectiveness.
- Opinion. Unqualified, or qualified. Read the basis if qualified.
- Scope. Which system, which locations, which trust services categories. Does it cover the service you buy?
- Exceptions. In the tests section, find any deviations noted and the management response.
- Subservice organisations. Does the report include them or carve them out? Carved out means you may need their reports too.
- Complementary user entity controls. These are controls the vendor assumes you operate, such as managing your own user accounts. Map each to a control of yours. This is the part most teams skip.
- Changes during the period. Acquisitions, infrastructure moves, major incidents.
Write a half page memo per critical vendor: what you reviewed, what you found, your decision, the reviewer and the date.
What evidence do you keep?
- Vendor inventory with tier, owner, data types, last review date.
- Requests and received reports, filed by vendor and year.
- Review memos and the CUEC mapping.
- Contracts or data processing terms with security and breach notice clauses.
- Gap log with decisions and approvals.
- Offboarding records for exited vendors.
Which mistakes recur?
- A report received but never read.
- A review date after the vendor's report period ended a year ago, with no bridge letter.
- No tiering, so a payroll tool and a code host receive identical scrutiny.
- CUECs ignored.
- Reviewing just the vendors that remember to send reports.
- Treating "has SOC 2" as a finding of "is safe". The report describes controls over a scope. It is one input.
What to do
- Build the merged vendor list this month.
- Define tiers in one paragraph and apply them.
- Assign owners and put the four quarterly steps on the compliance calendar.
- Request reports from critical and important vendors now, since replies take weeks.
- Review with the seven point checklist and write the memos.
- Map CUECs to your own controls and test the gaps.
- Get management sign off on accepted risks.
- File everything by vendor and year.
Quick check
Is a Type 1 report from a vendor good enough?
It tells you the controls were suitably designed at a point in time and says nothing about operating effectiveness. For critical vendors, ask for a Type 2, or document the compensating checks you perform and why you accept the risk.
What is a complementary user entity control?
It is a control the vendor's report assumes you, the customer, operate, for example reviewing your own user accounts. Map each one to your own controls, because a gap there can undermine the vendor's design.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code rather than by screenshot, and monitoring keeps running between audits. For vendor risk, Safeguard's scans, SBOMs and reachability analysis show which third party packages are in your code and which findings are actually reachable, which complements a vendor's own attestation with facts from your environment. Safeguard's agent can also open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard helps prepare and keep evidence ready and does not replace the auditor. Book a call.
Sources
- AICPA, 2017 Trust Services Criteria with revised points of focus (2022), criterion CC9.2 and the Type 1 and Type 2 descriptions. Paraphrased.
Last reviewed: 18 October 2026.
