FAQ: Do we need a list of every supplier our vendor uses?

Usually, start with providers that could materially affect your service or data. For each relevant provider, ask:

What does it do?
What access does it have?
What happens to our service if it fails?

If names or reports cannot be shared, ask for alternative evidence and record what remains unknown. Do not assume you have a direct audit right. Decide whether the remaining uncertainty is acceptable for the service you intend to use.

Read more: What Should We Ask a Vendor About Its Fourth-Party Dependencies?.

Additional FAQs

What does meaningful human review of AI output look like?

Give the reviewer a clear task, enough information, and authority to reject or correct the result. Define what to check, which cases require escalation, and what record to retain. For

What is a SOC 2?

SOC 2 is an independent CPA examination of a service organization’s described system and controls against the applicable Trust Services Criteria. SOC stands for System and Organization Controls. A Type

What should we track if we manage third-party risk manually?

Keep a shared register that lets a colleague see why a service was accepted and what still needs attention. Include: Link supporting records rather than copying everything into the spreadsheet.

When are we ready to start a SOC 2 Type 2 reporting period?

Discuss the start date with the auditor after the in-scope controls are implemented and evidence collection is working. Check actual operation: can you retrieve an access approval, a completed review,

What should we settle before asking for SOC 2 audit quotes?

Start with a short scope brief. Name the service customers use, the legal entity providing it, the systems supporting it, and the report customers expect. Include your target delivery date,

Should we wait for the proposed SOC 2 updates before improving AI controls?

No. Begin with the AI uses and risks you already have. Identify owners, document data flows, review access, define appropriate human oversight, and retain records of important decisions and evaluations.

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide