It requires the subservice organization's cooperation and a written assertion from its management, so it is used for closely tied vendors such as affiliates or dedicated managed service providers.
Compare the carve-out method.
Read more
Related terms
- Carve-out method
- The carve-out method is the way a SOC report treats a subservice organization by excluding its controls from scope and listing the controls assumed of it.
- Subservice organization
- A subservice organization is a vendor that performs part of the service a SOC report covers, such as a cloud hosting provider or a managed database service.
- Management's assertion
- Management's assertion is the signed statement in a SOC report that the service organization's description and controls meet the criteria.