· Amit Kothari · Operations
SOC 2 vendor management when you cannot get their SOC 2 report
Not every vendor will hand over their SOC 2 report. Some gate it behind enterprise tiers, some do not have one, and some just ignore the request. Your auditor still expects you to manage vendor risk. Here is the workaround that actually satisfies the CC9.2 criteria.