SOC 2 Subservice Organization Questionnaire — what your customer's auditor needs

1. 1.1
   Most recent SOC 2 Type II report — audit period, audit firm, opinion (unqualified / qualified). Provide a bridge letter if older than 12 months.
   Critical
2. 1.2
   List any qualifications, exceptions, or carve-outs in the latest SOC 2 and the remediation status of each.
   Critical
3. 1.3
   Logical access — describe provisioning, quarterly access reviews, and termination workflow for production access.
   Critical
4. 1.4
   Change management — describe approvals, segregation of duties, and emergency-change controls.
   High
5. 1.5
   Vulnerability management — scanning frequency, patch SLAs by severity, evidence of remediation.
   High
6. 1.6
   Risk assessment — frequency, methodology, link to compensating controls.
   Medium

1. 2.1
   Published uptime SLA and current trailing-12-month actual availability per region.
   Critical
2. 2.2
   RTO and RPO commitments, plus the date and result of the most recent DR test.
   High
3. 2.3
   Capacity-planning process and how customers are notified of degraded performance.
   Medium
4. 2.4
   24/7 monitoring and on-call structure — internal SOC, MSSP, or hybrid?
   High

1. 3.1
   Encryption at rest and in transit — algorithms, key length, KMS provider, rotation cadence.
   Critical
2. 3.2
   Data classification scheme and corresponding handling controls.
   High
3. 3.3
   Customer data retention defaults and termination-deletion SLA (production + backups).
   Critical
4. 3.4
   Non-disclosure obligations for workforce — sample NDA terms.
   Medium

1. 4.1
   How do you detect and reconcile incomplete or duplicate processing of customer transactions?
   High
2. 4.2
   Describe input-validation, business-rule, and reconciliation controls in the critical processing path.
   High
3. 4.3
   How are processing errors surfaced to customers? Provide a sample error notification.
   Medium

1. 5.1
   Public privacy notice URL. Last review date and the legal review log.
   Critical
2. 5.2
   How are data subject rights (access, deletion, portability) handled — process, owner, SLA?
   High
3. 5.3
   Cross-border transfer mechanisms (SCCs, BCRs, adequacy decisions) and the countries involved.
   High
4. 5.4
   Privacy-incident response procedure and notification triggers.
   Critical

1. 6.1
   Provide the list of CSOCs your customer is expected to perform (e.g. manage their own users, configure SSO, monitor their own usage).
   Critical
2. 6.2
   How do you communicate CSOC updates to customers (release notes, banner, email)?
   High

Run a free SOC 2 / AICPA TSC audit. ComplianceIQ uses your audit responses and generated policies to populate an answer pack you can paste into any SIG, CAIQ, or custom enterprise questionnaire — in minutes, not days.