FAQ: Can different vendors still leave us dependent on the same provider?

Yes. Two vendors may use the same cloud service, identity provider, or other essential supplier, so one disruption could affect both. Compare known dependencies across your important services and ask whether your backup option shares the dependency you are trying to avoid. Sharing a provider does not automatically make the arrangement unacceptable: the relevant service, region, architecture, and recovery arrangements matter. Record the common failure you are concerned about and what you could still operate if it occurred.

Additional FAQs

How long does a SOC 1 take to complete?

There is no fixed completion time. Estimate three parts: getting controls and evidence ready, the period a Type 2 report will cover, and the auditor’s fieldwork and report review. Some

What does meaningful human review of AI output look like?

Give the reviewer a clear task, enough information, and authority to reject or correct the result. Define what to check, which cases require escalation, and what record to retain. For

Are Third Party Vendor reviews required for SOC 1 and SOC 2?

Review outsourced services that can affect the in-scope system or controls. The extent of review should reflect the service and its risks. Where a vendor supplies an assurance report, assess

What is SSAE 18 (formerly SSAE 16)?

SSAE No. 18, Attestation Standards: Clarification and Recodification, is an AICPA standard that clarified and recodified the attestation standards. It superseded SSAE No. 16 and other earlier standards, with specified

How do we keep recurring SOC 2 tasks from being missed?

Create a calendar from the actual controls, not from a generic monthly checklist. Include the owner, backup, due date, evidence required, and escalation contact for each recurring activity. Add event-driven

What should we monitor after an AI feature goes live?

Monitor the outcomes that matter for the approved use, not just whether the service is online. Consider error reports, unexpected actions, review overrides, complaints, and meaningful changes in output quality.

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide