Guide

SOC 2 Subservice Organizations: What They Cover, What They Don't, and Why It Matters

If you use third-party services, you need to understand how their SOC 2 reports affect yours.

If your SaaS company uses third-party services that have their own SOC 2 reports, those vendors are considered subservice organizations. Their SOC 2 compliance can impact your audit because auditors will want to see that you have controls in place to manage the risks associated with those vendors. This guide explains what subservice organizations are, how their SOC 2 reports affect your audit, and what steps you need to take to ensure that your compliance isn't jeopardized by your vendors' security posture.