They are listed in the system description under the carve-out method, such as physical security at a cloud provider's data centres. Because they are not tested in the report, the reader has to rely on the subservice organization's own assurance.
See carve-out method and subservice organization.
Read more
Related terms
- Complementary user entity controls
- Complementary user entity controls are controls a SOC report assumes the service organization's customers operate themselves for the criteria to be met.
- Subservice organization
- A subservice organization is a vendor that performs part of the service a SOC report covers, such as a cloud hosting provider or a managed database service.
- Carve-out method
- The carve-out method is the way a SOC report treats a subservice organization by excluding its controls from scope and listing the controls assumed of it.