SOC 2 Bridge Letters: What They Are and What Goes in One

A SOC 2 report covers a fixed period that ended in the past. Customers buying today want to know that nothing has fallen over since. The bridge letter is how a service organisation answers that question between reports.

Short answer

A SOC 2 bridge letter (sometimes called a gap letter) is a short statement from the service organisation’s management covering the time between the end of the last report period and the present. It confirms whether there have been significant changes to the system or controls, states that controls continue to operate, and says when the next report is due. It is not audited, and it usually covers no more than about three months.

What goes in a bridge letter

• The name of the service and system covered by the last report.
• The start and end dates of the last report period, and the CPA firm that issued it.
• The period the letter covers, from the end of the report period to the date of the letter.
• A statement of any significant changes to the system, controls, key people or subservice providers, or confirmation that there were none.
• Confirmation that management is not aware of any material control failures or security incidents affecting the service, or a description of them.
• When the next report period ends and when the report is expected.
• The signature of a senior executive, with title and date.

When customers ask for one

Procurement and vendor risk teams ask for a bridge letter when the last report period ended some months ago, typically during onboarding or an annual vendor review. A customer’s own auditors may also ask for it, because the customer is relying on the service organisation’s controls for its own reporting.

Getting it right

• Keep the gap short. Plan report periods so the end date is never too far from when customers need assurance. Consistent twelve-month cycles help.
• Disclose changes honestly. A new cloud provider, a major platform migration or a security incident belongs in the letter.
• Back it with evidence. Management is attesting that controls kept operating. The evidence routine from the audit should still be running.
• Ask the auditor to review the wording. They will not sign it, but they can check it does not overstate anything.

If you are on the receiving end, how to review a supplier’s SOC 2 report covers what to check in the report and the bridge letter together.

How Streamline helps

We help service organisations keep their SOC 2 evidence routine running between audits, so a bridge letter is a statement of fact rather than a hope. We are independent of the CPA firm that issues the report, so we prepare you properly rather than marking our own homework, and we usually build on an ISO 27001 foundation so the same work supports both. Read about our SOC 2 readiness and advisory or talk to us about SOC 2.

More on SOC 2

• The SOC 2 guide: what it is and how it works
• SOC 2 cost in Australia
• SOC 2 readiness assessment and checklist
• How to choose a SOC 2 auditor
• How to review a supplier’s SOC 2 report
• ISO 27001 vs SOC 2

Frequently asked questions

Who signs a SOC 2 bridge letter?

The service organisation’s management, usually a senior executive such as the CEO, CFO or head of security. The CPA firm does not issue or sign it, although it may review the wording.

How long can a bridge letter cover?

Typically no more than about three months after the end of the last report period. Customers become less comfortable as the gap grows.

Is a bridge letter audited?

No. It is a statement by management, not an attestation. Its value comes from the credibility of the last report and the honesty of the disclosure.

What if something changed since the last report?

Say so. Significant changes to systems, controls, providers or people should be disclosed in the letter. Leaving them out undermines trust when a customer finds out later.