A critical provider goes offline. The employee who alone knows how to restore the service is unavailable. A software partner changes how it handles customer information. Each situation can affect a company’s ability to meet its commitments, even when its own systems are well managed.
CC9, the Risk Mitigation group within the SOC 2 common criteria, addresses potential business disruptions and risks associated with vendors and business partners. It helps connect the risks a company has identified with practical arrangements for reducing their consequences.
A dependency becomes a serious problem when the company has made promises it cannot meet without it. A backup service may appear inexpensive until the team discovers it holds the only recoverable copy of customer data. A provider with a strong reputation can still operate a service that does not meet a particular customer’s needs.
Suppose a small software company depends on one cloud provider and one administrator. A useful review asks what happens if either becomes unavailable. The team might arrange backup administrative coverage, verify that recovery information remains accessible, and test how it would communicate during an outage. Management can then decide whether additional measures are justified by the likely interruption and customer commitments.
Vendor oversight supports those decisions throughout the relationship. Selecting a provider is only the beginning; changes in its service, access, or performance can alter the risk the company originally accepted.
The following descriptive labels summarize the two criteria. They are editorial labels, not official AICPA titles.
A continuity exercise might reveal that an alternate supplier cannot receive the data needed to restart a service. That result should lead to a revised recovery approach or an informed decision about the remaining exposure. Similarly, a vendor review should produce a decision when important evidence is missing, rather than ending with a completed questionnaire.
See the AICPA Trust Services Criteria for the complete criteria and related points of focus. The examples here are practical suggestions rather than a prescribed checklist.
Customers want to understand whether the company has considered the dependencies behind its service and made credible plans for problems. Useful questions include:
Supporting evidence may include dependency records, business impact assessments, continuity exercises, vendor review decisions, and follow-up on identified weaknesses. A provider’s SOC 2 report can inform a review, but the reviewer still needs to consider the services covered, reporting dates, exceptions, and responsibilities left to customers. A report saved in a folder does not show that those questions were evaluated.
A Type 1 report addresses the system description and suitability of control design as of a specified date. A Type 2 report also addresses operating effectiveness over a specified period and includes the auditor’s tests and results. Review the report’s scope and opinion, along with any exceptions and relevant customer responsibilities. An examination does not guarantee that a provider will remain available or that every disruption can be avoided.
CC9 overlaps with incident recovery under CC7, but its disruption perspective is broader than security incidents. It also does not, by itself, mean the separate Availability category was included in the examination. Check which categories and services the report actually addresses before relying on a resilience claim.
These examples illustrate proportionate ways to organize the work. Actual controls should reflect the importance of each dependency and the consequences of its failure.
Headcount and supplier spending are imperfect measures of exposure. A low-cost tool with administrator access can deserve more scrutiny than a much larger purchase with no access to the service. Multi-region infrastructure, a particular vendor-review frequency, and insurance coverage are not universal SOC 2 requirements. Select measures that address the company’s risks and validate the assumptions behind them.
The individual articles will examine these topics in greater detail, with practical controls and supporting evidence. Links will be added as the articles are published.
Discuss your SOC 2 objectives with Genius GRC and identify controls and supporting evidence that fit your service commitments, critical dependencies, and available resources.
