It is the usual choice, and the only practical one for large providers such as public clouds. The subservice organization's controls are not tested, so readers need its own report for that part of the service.
Compare the inclusive method.
Read more
Related terms
- Inclusive method
- The inclusive method is the way a SOC report treats a subservice organization by bringing its relevant controls into the examination and testing them.
- Subservice organization
- A subservice organization is a vendor that performs part of the service a SOC report covers, such as a cloud hosting provider or a managed database service.
- Complementary subservice organization controls
- Complementary subservice organization controls are controls a SOC report assumes a carved-out subservice organization operates for the criteria to be met.