How to review a vendor's SOC 2 report: what to actually look for
SOC 2 has become the default currency of vendor security in the US. Nearly every B2B software vendor has one, and nearly every buyer asks for it. But in many companies the review stops at "yes, they sent it". The PDF gets filed, and nobody reads past the cover page.
That's a missed opportunity, because the useful information is inside. Here's what to look at, in the order that saves the most time.
1. Type I or Type II
A Type I report says the vendor's controls were suitably designed at a single point in time. A Type II report says the controls were designed and actually operated effectively over a period, usually six to twelve months. For any vendor that matters, ask for Type II. A Type I is fine as a first step for a young company, but it isn't evidence that anything works in practice.
2. The period and its date
Check the dates the report covers. A report whose period ended more than a year ago is stale. If there's a gap between the end of the period and today, ask for a bridge letter (sometimes called a gap letter), a statement from the vendor's management that nothing material has changed since. Note that it comes from the vendor, not the auditor.
3. Scope: does it cover what you're buying?
SOC 2 reports cover specific systems and one or more of the five Trust Services Criteria: Security (always included), Availability, Processing Integrity, Confidentiality and Privacy. Make sure the system described is the product you're actually buying, and that the criteria match your needs. If uptime matters to you, a report without Availability leaves a gap.
Also check how subservice organizations are handled. Most vendors run on a cloud provider, and the report usually "carves out" those providers, meaning their controls weren't tested here. You may need to look at those providers' own reports too.
4. The auditor's opinion
Near the front is the auditor's opinion. An unqualified (clean) opinion is what you want. A qualified opinion means the auditor found problems significant enough to call out, and an adverse opinion or a disclaimer is a serious red flag. Read the reasons, not just the label.
5. Exceptions: where the real information is
In a Type II report, the section describing the auditor's tests lists any exceptions: cases where a control didn't work as described. One missed access review may be minor. Repeated failures in access management, change management or incident response deserve a follow-up question. Many reports include the vendor's response to each exception; read that too.
6. Your side of the bargain: CUECs
Complementary user entity controls are controls the vendor assumes *you* will run, such as reviewing who has access to your account or enabling multi-factor authentication. If you don't do them, the vendor's controls may not protect you. List them, assign an owner, and check they're actually happening.
Make it repeatable
The review only helps if it happens every time and is recorded. Our free third-party risk checklist includes these SOC 2 checks as part of the full vendor lifecycle.
In Granur, vendors upload their SOC 2 report through a secure link, and Granur's AI reads it for you: which Trust Services Criteria are covered, the report type and period, the opinion, and any exceptions. It compares that against your own requirements, such as Type II, twelve months, Security included, flags what falls short, and tracks the report's expiry so you ask for next year's in time.