Typical examples are customers managing their own users' access, enforcing MFA through their identity provider, and protecting the API keys issued to them. The auditor does not test them, and the opinion is conditional on them.
The guide to CUECs and subservice organizations covers them in detail.
Read more
Related terms
- Complementary subservice organization controls
- Complementary subservice organization controls are controls a SOC report assumes a carved-out subservice organization operates for the criteria to be met.
- Subservice organization
- A subservice organization is a vendor that performs part of the service a SOC report covers, such as a cloud hosting provider or a managed database service.
- System description
- The system description is management's account of the system a SOC 2 covers, written against the AICPA DC 200 description criteria.