Due diligence checklist, United States
SOC 2: what to ask a vendor
SOC 2 examination (AICPA Trust Services Criteria). AICPA. Banks routinely ask for a SOC 2 Type II report as evidence of a vendor's controls.
What it is
Banks routinely ask for a SOC 2 Type II report as evidence of a vendor's controls.
A standard rather than a regulation: institutions ask for it, no regulator requires it of every vendor.
Who it applies to
Applies to every financial institution in the United States. A standard rather than a regulation: institutions ask for it, no regulator requires it of every vendor.
What to ask a vendor, and the evidence to request
| # | Ask the vendor for | Evidence to request |
|---|---|---|
| 1 | A current SOC 2 Type II report covering the service | The current report or certificate, dated within the last twelve months, with its scope checked against the service being bought. |
In every case
- A named contact at the vendor responsible for this regime, and how the vendor tracks changes to it.
- Which named customers the vendor already serves under this regime, as references you may call.
This checklist is a starting point for a procurement team, not legal advice. Read it with the regulator's own page, your institution's policies and your legal and risk teams; the regime may have changed since the date on this document.
Next
- Every checklist, by country
- What a market scan is and how to run one
- Have Vederca run the procurement: the regime goes into the register as a must-have