Your MSP's SOC 2 does not cover you. Here is what it covers.
Your provider's SOC 2 report covers controls at the provider, for the systems described, over a stated observation period. It never covers your environment. It also lists complementary user entity controls, the jobs the auditor assumed you were doing, and the clean opinion depends on them. Ask for that list in writing.
- A SOC 2 report describes controls at your provider, for the systems it chose to describe, across a stated period. Your own environment is never in scope.
- Every report carries complementary user entity controls. Those are the jobs the auditor assumed you were doing, and the clean opinion is conditional on them.
- Under the carve-out method, the subcontractor holding your data can sit outside the examination. Ask which subservice organizations were carved out.
- Compare the observation period with your own start date. A window that closed before you signed says nothing about the service you buy today.
- Request the full Type II report under a non-disclosure agreement, plus your CUEC list in writing, then give every line an owner and a date.
What does your MSP's SOC 2 report actually cover?
Your provider's SOC 2 report covers controls at your provider. It covers them across a stated period, for the systems your provider chose to describe. Your network, your Microsoft 365 tenant and your staff sit outside it. The AICPA, which writes the standard, titles its own guidance an examination of controls at a service organization. The phrase at a service organization does all the work in that sentence. Your environment is a different place, and nobody examined it.
That is the honest purpose of the document, not a flaw in it. The AICPA says SOC reports provide users with valuable information that is needed to assess and address the risks associated with outsourcing services. Assess and address are two separate jobs, and the second one stays with you. The yardsticks behind the report are control criteria established by the AICPA's Assurance Services Executive Committee, so the report measures your provider against a published standard rather than against your risk register.
This guide assumes you already know that SOC 2 is an attestation and not a certificate. If that is new, read Is SOC 2 a certification? What to ask for instead first, then come back here. This post answers the harder question. What does a clean report actually say about you?
The question earns its keep because your IT provider is your largest third party. Verizon found breaches involving a third party now accounting for 48% of all breaches, after third-party supply chain breaches jumped 60% in a single year. CISA, the NSA and the FBI warned that threat actors can use a vulnerable MSP as an initial access vector to multiple victim networks. So the scope of your provider's report is not paperwork. It is the map of what somebody independent has checked.
Complementary user entity controls are your homework, written by their auditor
Complementary user entity controls are the controls your provider's auditor assumed you were running. The report names them, usually in a short section near the system description. The provider's clean opinion is conditional on them, because controls at the provider only reach their stated goals if your side holds up its end. The AICPA treats this as core material. Its own SOC attestation guidance covers Complementary User Entity Controls (CUEC) and subservice organization determinations among the key portions of the guidance.
Read that again slowly, because this is the part almost nobody is shown. One section of your provider's audit report is a list of your own jobs. It was written by somebody else's auditor, about systems that auditor never examined, and it is the condition attached to the assurance you were just handed. The file usually gets closed once somebody reads the opinion at the front.
What those controls look like in practice
The lines read like ordinary IT hygiene, and federal guidance for MSP customers covers the same ground for free. CISA tells customers to ensure MSP accounts are not assigned to internal administrator groups, to disable MSP accounts that are no longer managing infrastructure, and to enable effective monitoring and logging of their systems. It also warns that disabling MSP accounts can be overlooked when a contract terminates. Somebody has to monitor those accounts, and the report assumes that somebody works for you.
Now treat the list as an audit finding waiting to happen. Nobody at your provider owns those lines, because the report excludes them from the provider's own control set. If nobody at your business owns them either, the gap is real and the opinion is still clean. Both statements are true at the same time, which is exactly why this section matters more than the opinion page.
The list needs four things from you once it arrives.
- Request it as a standalone document. Ask for the complementary user entity controls on their own page, with the report page numbers beside them.
- Assign an owner to every line. A control with no named owner is a gap with a tidy label.
- Date each one. Record when it was last checked, because an untested control is a claim rather than a control.
- Keep it beside the contract. The report is evidence about their controls. This list is a statement about yours.
Can a SOC 2 report exclude the company that holds your data?
Yes. Under the carve-out method, the provider's report excludes its own subcontractors' controls from the examination. Those subcontractors are called subservice organizations. The cloud platform, the backup vendor and the security operations partner behind your service can all sit outside the report you were handed, while the report itself stays completely accurate.
This is published practice, disclosed in plain words. One large enterprise software vendor's own trust page states that this examination's scope does not include the controls of any subservice organizations. That single sentence is the carve-out method, written exactly as it should be. The vendor did nothing wrong by printing it. The reader who skips it is the one who ends up over-covered in their own mind.
The inclusive method is the other route. It brings the subservice organization's relevant controls into the provider's system description and into the auditor's testing, which asks more of the subcontractor because it agrees to be examined. So your practical question is short. Which method did your provider use, and which names were carved out?
Regulators already treat subcontractors as your problem
Both US and Canadian regulators push the subcontractor question back onto the customer. The 2023 federal interagency guidance tells banking organizations to obtain and evaluate information regarding the third party's legally binding arrangements with subcontractors, and to consider whether a contract includes provisions for periodic, independent audits of the third party and its relevant subcontractors. Canada's financial regulator states that the FRFI is responsible for identifying, monitoring and managing risk arising from subcontracting arrangements and suggests contract terms allowing the FRFI to commission or conduct an audit of subcontractors. FRFI means a federally regulated financial institution. You are probably not one. The test still travels well.
Does the observation period cover the time you were a customer?
Usually not all of it, and sometimes none of it. A SOC 2 Type II report states an observation period, which is the window the auditor tested across. Put that window beside your own start date and count the months that overlap. For a business that signed last quarter, the overlap is often zero.
Published windows are long and they close well before anyone reads them. One vendor's published SOC 2 Type II summary covers the audit period 1 April 2024 to 31 March 2025, a 12 month window. A buyer reading that today is reading about controls that operated more than a year ago, at a company that has since changed staff, tools and subcontractors. That is normal, and it is the reason the date matters as much as the opinion.
A bridge letter covers the gap on paper only. It is management's own statement that nothing material changed after the observation period closed. No auditor signs it, so no opinion attaches to it. Treat it as context, then ask when the next examination window ends.
Controls decay inside that gap, and the numbers are blunt about it. Verizon found only 26% of critical known exploited vulnerabilities were fully remediated in 2025, down from 38% the year before, and that the median time for full resolution went up to 43 days. IBM measures an average of 247 days to identify and contain an active breach. An intrusion can begin inside a tested window and surface long after the report was signed.
Three lines that tell you where you stand
Read three parts of the report in order, after the dates. The management assertion names who claimed what about the system. The opinion says whether the auditor agreed, and a qualified opinion marks the place where they did not. The results section lists the exceptions, which are the deviations the auditor actually found. Then read the exceptions beside your complementary user entity controls, because a failure on your side of the line never shows up in either place.
How does a SOC 2 report fit your vendor risk management file?
Treat the report as one input to vendor risk management rather than the answer to it. The test regulators apply is relevance. US bank regulators tell supervised firms to consider whether the scope and the results of the SOC reports, certifications, or assessments are relevant to the activity to be performed. Canada's regulator says a firm should be able to access audit reports in respect of the service being performed for the FRFI.
Both sentences aim at the same gap. A genuine report about a platform you never touch is not evidence about the service you buy. So match the report against your invoice, verify each line you pay for, and write down what you cannot find. That written list of gaps is worth more than the report itself, because it is the only part of the exercise aimed at your business.
The contract carries the rest. The interagency guidance notes that a contract often establishes the banking organization's right to audit and provides for remediation, and that terms should set the types and frequency of audit reports the banking organization is entitled to receive from the third party. A contractual right to audit and a named reporting cadence cost nothing at signing and are very hard to add later.
The stakes are ordinary business stakes. IBM puts the global average cost of a data breach at USD 4.99 million, and Verizon found nearly a third (31%) of all breaches start with vulnerability exploitation. Patching is the sort of work a managed provider does on your behalf. If patching is the service you buy, patching is what the report has to cover.
A clean report plus an unowned list of complementary user entity controls is not coverage. It is a shared control environment with one half unstaffed.
What should you ask your provider this week?
Ask for four things in writing, then keep every answer in one file.
- Request the full report under an NDA. A SOC 2 report is a restricted-use document in normal practice. One vendor's trust page states that the use of these reports is restricted and that copies go to customers and prospects with a non-disclosure agreement in place, so a non-disclosure agreement is the normal route rather than a brush-off.
- Ask for your CUEC list. Request the complementary user entity controls as a separate written list, then assign each line to a named person inside your business.
- Ask which names were carved out. Get the subservice organizations in writing, and ask for each one's own current report.
- Ask for the dates and the exceptions. Get the observation period, the report date, every exception the auditor recorded, and the management assertion that sits in front of them.
Two fairness notes keep this straight. A provider holding a real report while a customer misreads its scope is the normal case, not misconduct, and the phrasing on a sales page is usually just the phrasing buyers use. The report, written to the reporting requirements of SSAE-21, is an audit deliverable rather than a promise to you. Promises belong in the contract.
What follows is ordinary work on your side of the line. CISA tells customers to understand the supply chain risk associated with their MSP and to make sure incident response and recovery plans are tested at regular intervals. Read how to audit your MSP's own security and who at your MSP can log into your systems at 2am for the two questions that sit beside this one, then use HIPAA vs CMMC vs SOC 2 if you are still choosing a framework.
No report makes a provider safe, and no honest provider claims otherwise. A SOC 2 report is a narrow, independent, dated statement about somebody else's controls, and it is genuinely useful once you read it that way. Read the part about you, name an owner for every line, and the document starts earning the trust it gets handed.
FAQ
What are complementary user entity controls?
Complementary user entity controls are the controls your provider's auditor assumed you were operating. The report lists them, and the provider's clean opinion depends on them. The AICPA's SOC attestation guidance covers Complementary User Entity Controls (CUEC) directly. Ask for your list in writing, then give every line a named owner inside your business.
Does my MSP's SOC 2 report cover my business?
No. It covers controls at your provider, for the systems described, across a stated period. The AICPA calls it an examination of controls at a service organization. Your network, accounts and staff are not examined. Compare the report's scope against the services on your invoice to see what it does cover.
What is the carve-out method in a SOC 2 report?
The carve-out method excludes a provider's subcontractors from the examination. One vendor's published summary states that this examination's scope does not include the controls of any subservice organizations. The inclusive method tests those controls instead. Ask which subservice organizations were carved out, then ask each one for its own current report.
Can I ask my MSP for its full SOC 2 report?
Yes, and expect a non-disclosure agreement first. These are restricted-use documents. One vendor's trust page states that the use of these reports is restricted and that copies go to customers and prospects with a non-disclosure agreement in place. A firm holding a current Type II report can usually share it quickly.
Is a bridge letter enough to cover the gap after the observation period?
No. A bridge letter is management's own statement that nothing material changed after the period closed, and no auditor signs it. Use it as context, not evidence. Verizon put the median time for full resolution of a critical vulnerability at 43 days, so a quarter is long enough for the picture to move.
Best IT MSP is the independent directory of managed IT and cybersecurity providers across the US and Canada. Organic ranking is earned on verified rating and firmographic data, and paid placement is always labelled. Shortlist three firms in your city, then ask all three for the report, the carve-out names and your CUEC list.