FAQ: Do we need a list of every supplier our vendor uses?

Usually, start with providers that could materially affect your service or data. For each relevant provider, ask:

What does it do?
What access does it have?
What happens to our service if it fails?

If names or reports cannot be shared, ask for alternative evidence and record what remains unknown. Do not assume you have a direct audit right. Decide whether the remaining uncertainty is acceptable for the service you intend to use.

Read more: What Should We Ask a Vendor About Its Fourth-Party Dependencies?.

Additional FAQs

We have a small company, how do we segregate Board of Directors from Management, and then, also the Internal Audit function?

Map three roles: who runs controls, who oversees management, and who independently evaluates the results. Mark where the same person fills more than one role. For example, a suitably independent

How long does a SOC 1 take to complete?

There is no fixed completion time. Estimate three parts: getting controls and evidence ready, the period a Type 2 report will cover, and the auditor’s fieldwork and report review. Some

Can an organization opt for both SOC2 and ISO 27001?

Yes. SOC 2 provides a CPA examination report about a defined service system and its applicable Trust Services Criteria. ISO/IEC 27001 certification concerns an information security management system within a

What belongs in a simple SOC 2 control register?

Use one row per control with a stable identifier, a plain-language description, an owner, a frequency or trigger, and an evidence location. Add the relevant criteria mapping, the systems covered,

We have a SOC 2. How much effort is GDPR?

Estimate the extra effort by mapping the personal-data activities and GDPR obligations that apply, then comparing them with your existing controls and evidence. Sort the gaps into three groups: already

How should we compare SOC 2 audit proposals beyond price?

Compare the same scope, report type, period, and delivery assumptions first. Then ask about the engagement team's experience with your service, partner involvement, evidence requests, communication cadence, and how scope

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide