Required
Security
The common criteria, CC1 to CC9, cover governance, risk, access, operations and change. Every SOC 2 report includes them.
SOC 2 reports, read and kept with each supplier
SOC 2 is a report, not a certificate. An independent CPA firm examines a company’s controls against the AICPA’s Trust Services Criteria and gives its opinion. Many of the cloud and SaaS suppliers you rely on hand one over instead of an ISO certificate.
Montro keeps each supplier’s SOC 2 report with its entry, with the period it covers and the points your team needs to act on. When a report runs out of date, it comes back to your team for review.
Framework
What a SOC 2 examination covers
Five Trust Services Criteria set the scope. Security is always included, and the supplier chooses whether to add any of the other four.
Optional
Availability, confidentiality, processing integrity and privacy
Added when the service calls for them. A report without the privacy criteria says nothing about how personal data is handled.
Suppliers
Vendor and business partner risk
Criterion CC9.2 asks a company to assess and manage the risks from its own vendors. If you hold a SOC 2 report yourself, your suppliers’ reports become part of your evidence.
How Montro helps
Each supplier’s report, on record and in date
Montro keeps the SOC 2 reports your suppliers send against their entries, and raises the changes that fall outside what those reports cover.
Reports kept with the supplier
The report, its type, the period it covers and the criteria in scope sit with the supplier’s entry, ready when someone asks for them.
Gaps between reports, raised
When a report’s period ends and no new report or bridge letter arrives, Montro raises it for your team to follow up.
Changes the report doesn’t cover
A new sub-processor or AI switched on after the report period isn’t in the auditor’s opinion. Montro raises it, the supplier confirms, and your team decides.
What you get
What your team can act on
A report is only useful once someone acts on what it says.
Your controls
Complementary controls, each with an owner
Reports list controls the customer is expected to run, such as reviewing who has access. Each one gets an owner on your side.
Exceptions
Exceptions noted and decided
Where the auditor found a control didn’t work as described, your team records whether it matters to you and why.
Subservice providers
The suppliers behind the report
Many reports leave out the supplier’s own providers, such as its cloud host. Those sit under the supplier’s entry, so you can see whose report covers what.
Type 1 and Type 2
A point in time, or a period of time
A Type 1 report says controls were designed properly on a single date. A Type 2 report also tests whether they worked over a period, often six to twelve months, so it tells you far more about how a supplier operates day to day.
Montro records which type each supplier holds and the dates it covers. A Type 1 can be accepted for now with a reason, and when the Type 2 arrives the entry moves on with the earlier decision kept.
Questions
Questions about SOC 2 reports, and how Montro keeps them with your suppliers.
No. It’s an attestation: a licensed CPA firm gives its opinion on the controls. There is no pass mark, so the opinion, the exceptions and the scope matter more than the logo on a website.
It’s useful evidence, but DORA, NIS2 and GDPR ask about things a SOC 2 report doesn’t always cover, such as where data is processed, sub-processor terms and exit plans. Montro keeps the report alongside those on the same entry.
A letter from the supplier covering the months between the end of its last report period and today. It’s the supplier’s own statement, not the auditor’s, so it carries less weight than the report.
No. None of the criteria requires it. Ask for evidence that fits the risk, whether a SOC 2 report, an ISO 27001 certificate or your own review, and record why it was enough.
The AICPA has proposed an update that would make vendor and business partner risk a category of its own. It’s still a draft: comments close on 15 January 2027, and if approved it would apply to examinations beginning on or after 31 December 2027.
Keep reading
Read SOC 2 alongside these
A supplier with a SOC 2 report often holds other evidence too, and your own obligations rarely stop at one framework.
DORA
For financial entities, a SOC 2 report supports the register of information but doesn’t replace it.
Read more
GDPR & RoPA
A report without the privacy criteria leaves processor questions for your record of processing.
Read more
CyFun
ISO 27001
The certificate many suppliers hold instead, and what its scope and dates tell you.
Read moreISO 42001
NIST
Third-party records are becoming decision logs. The firms that get this right will be the ones that can show who decided, on what evidence, and when.
- Pen-test summary on request
- Frankfurt hosting
- Sample register
- Expert Series guests
- Cyber Ireland member
See it on your own suppliers
A read-only connection, about an hour to set up, and a named person who can say yes to a decision.
Priced to scope — never per seat, never per supplier. Upgrade only when the evidence earns it.
