The report has to say how each one is treated: the carve-out method leaves its controls out of scope, and the inclusive method brings them in. Either way, the service organization still has to monitor its subservice organizations.
The vendor SOC 2 review checklist covers what a customer should check.
Read more
Related terms
- Carve-out method
- The carve-out method is the way a SOC report treats a subservice organization by excluding its controls from scope and listing the controls assumed of it.
- Inclusive method
- The inclusive method is the way a SOC report treats a subservice organization by bringing its relevant controls into the examination and testing them.
- Complementary subservice organization controls
- Complementary subservice organization controls are controls a SOC report assumes a carved-out subservice organization operates for the criteria to be met.