A vendor sent you their SOC 2 report. Now what?

You asked a software vendor about security and they sent back a 60-page PDF with an accounting firm’s letterhead on it. If your next move is saving it to the vendor folder and marking the task complete, you are in good company. That is what happens to most SOC 2 reports. It is also roughly as useful as not asking.

The report answers real questions, but not on page 1 and not in the marketing summary the vendor wrote to accompany it. Here is how to pull the value out in about 20 minutes, without pretending to be an auditor.

First, confirm what you are holding

Three things masquerade as “our SOC 2” and they are not equal:

• A Type 2 report covers whether controls existed and operated over a period, usually 6 to 12 months. This is the real thing
• A Type 1 report is a snapshot: the controls existed on one day. It is what young companies produce first, and it says nothing about whether anything actually ran. Fine for a startup vendor, worth a follow-up question about when Type 2 arrives. The difference matters enough that we wrote a whole post on it
• A “SOC 3” or a security one-pager is a public summary with the substance removed. If that is all a vendor will share, even under NDA, treat it as a yellow flag on its own

Check the period too. A Type 2 that ended 14 months ago is describing a company that may no longer exist in any meaningful sense. Coverage gaps between report periods are where surprises live.

The 4 places worth reading

Skip the front matter. The value concentrates in 4 sections.

1. The opinion, one page in

The auditor’s letter says whether the opinion is unqualified, meaning clean, or qualified, meaning “except for these problems.” A qualified opinion is not automatically disqualifying, but the exception it points to is now the most important sentence in the document. Vendors do not volunteer this in the cover email.

2. The scope, where the quiet limitation hides

The report covers a defined system, and vendors draw that boundary themselves. The product you actually use may sit outside it. A vendor with 4 products might scope the report to their flagship platform while the tool you bought lives on different infrastructure entirely. One sentence in the system description settles it, so find your product by name. While you are there, check which trust services categories were covered. Security is always in. Availability and confidentiality are optional, and their absence is a choice the vendor made.

3. The exceptions, the most honest part of the document

Somewhere in the back, the testing tables list every control that failed testing. Real reports have some. A report with zero exceptions across hundreds of tests should raise an eyebrow, not lower one. What matters is the shape:

• Ignorable. A missed access review in 1 quarter, remediated, with a management response that sounds like adults run the place
• Concerning. Exceptions in offboarding, in production access or in backup restoration, the controls that map directly to how a vendor loses your data
• Disqualifying, in context. The same exception appearing in last year’s report and this year’s. That is not a slip, it is a decision

Ask for the prior year’s report when you can. The comparison costs nothing and tells you whether exceptions get fixed or get furniture.

4. The subservice carve-outs

Most vendors run on someone else’s cloud, and most reports handle that with a carve-out: the cloud provider’s controls are excluded and listed as assumptions. That is normal. The part worth reading is the list of complementary controls the report assumes YOU perform, things like managing your own user accounts and configuring your own retention. If your customer questionnaire someday asks how you govern that vendor, this list is literally your homework, written by their auditor.

Calibrate the effort to the vendor

Not every vendor deserves 20 minutes. A sane small-company tiering:

• Crown-jewel vendors, the ones holding customer data or sitting in your revenue path: full read, annually, calendar reminder for the next report
• Operational vendors with some data access: opinion, scope and exceptions, once, then re-check at renewal
• Everything else: the report’s existence plus MFA and offboarding answers on a short questionnaire is proportionate

This slots into the broader process from vendor risk management for small business. The report is one input, not the whole assessment. A clean SOC 2 from a vendor whose invoices come from a personal Gmail address is still a vendor to watch.

Remember what the report is not

A SOC 2 is an auditor’s opinion that described controls operated during a window, within a scope the vendor chose. It is not a penetration test, not a guarantee, and not a statement about the product’s security features. Vendors fail their customers in ways no control matrix captures. The report’s real value is narrower and still substantial: it separates vendors who run a disciplined operation from vendors who bought a nice PDF template, and the back half tells you which one you are reading.

If you are on the other side of this table, being asked to produce a SOC 2 rather than read one, the path and the sequencing mistakes to avoid are in SOC 2 readiness versus the audit. We are not a SOC 2 audit firm ourselves; we are the MSP that makes the audit reach a clean opinion.

And if a customer just dropped a 200-question security questionnaire on you that asks how you vet your vendors, that is a solvable afternoon, not a crisis. The walkthrough is here, and if you would rather have help building the vendor-review habit so the answer is simply “yes, here is our process,” talk to us.