Lion Cipher Lab
Read a vendor's SOC 2 Type II report like a risk reviewer: opinion, scope, CUECs, and the exceptions that matter
- GRC / Compliance
- Intermediate
- ~55 min
- Free · no account required
Why it matters
A vendor hands you a 60-page SOC 2 report, and the single most common thing that happens next is: someone skims the cover, sees the auditor's logo and the word 'unqualified,' files the PDF, and marks the vendor 'approved.' That is not a review -- it is a filing. A SOC 2 report is one of the richest risk documents a vendor will ever voluntarily give you, and almost all of its value lives in the parts people never read: which Trust Services Criteria are actually in scope (and whether they match what you need), whether the reporting period ended eight months ago (leaving a gap you own), which…
What you'll learn
- reading a SOC 2 report as a third-party-risk reviewer, not an auditee
- what SOC 2 is and how it differs from SOC 1 and SOC 3
- Type I (design at a point in time) vs Type II (design AND operating effectiveness over a period)
- the Trust Services Criteria and reading the scope for the categories YOU need
- reading the independent service auditor's opinion (unqualified / qualified / adverse / disclaimer)
- checking the reporting period against today and requesting a bridge / gap letter
- spotting carved-out subservice organizations you must assess separately
- extracting the CUECs (Complementary User Entity Controls) you are on the hook to implement
- reading Section 4 tests of controls, exceptions/deviations, and management responses
- writing a one-page vendor SOC 2 review memo with an accept/mitigate/reject call and residual risk
Steps in this lab
- What a SOC 2 report actually is -- and what it is not
- Type I vs Type II -- a photo versus a movie (and why it changes your review)
- Read the opinion first -- unqualified, qualified, adverse, or disclaimer
- Read the scope -- which criteria, which system, and which period
- Find the subservice organizations -- carved-out means more work for you
- Extract the CUECs -- the controls the report assumes YOU perform
- Read Section 4 -- the tests of controls, exceptions, and management responses
- A clean SOC 2 is not a security guarantee -- the reviewer's mindset
- Write the one-page vendor SOC 2 review memo