[How-To] How To Request And Analyze A Hosting Provider’S SOC 2 Bridge Letter

When your organization undergoes an annual security audit, your auditors don't just look at your internal controls—they also evaluate the security posture of your critical subservice organizations. For most modern businesses, this means your cloud hosting provider (such as AWS, Google Cloud, or Microsoft Azure).

To prove your vendors are secure, you will need to review their SOC 2 Type II report. However, because audit cycles rarely align perfectly, you will often find a time gap between the end date of your hosting provider’s SOC 2 report and the start date of your own audit.

This is where a SOC 2 bridge letter (also known as a gap letter) becomes essential.

This step-by-step guide will walk you through exactly what a bridge letter is, how to request one from your hosting provider, and how to analyze it to satisfy your auditor's requirements.

What is a SOC 2 Bridge Letter (and Why Do You Need One?)

A SOC 2 bridge letter is a formal document issued by a service provider’s management team. It bridges the gap between the end date of the provider's most recent SOC 2 Type II report and the current date or the end of your own organization's audit period.

Because SOC 2 reports are historical documents covering a specific review period (typically 6 to 12 months in the past), auditors want assurance that the hosting provider’s controls have not failed or significantly changed since that report was published.

The Difference Between a SOC 2 Report and a Bridge Letter

It is a common misconception that a bridge letter can replace a full security audit. The table below outlines the core differences between these two documents:

When is a Bridge Letter Necessary?

You will need to request a bridge letter when your organization's audit period extends beyond the coverage dates of your hosting provider's SOC 2 Type II report.

Example: Your company’s SOC 2 audit covers January 1 to December 31. Your hosting provider’s latest SOC 2 report only covers the period from January 1 to September 30.
The Gap: There is a three-month gap (October 1 to December 31) where you have no audited proof of your host's security.
The Solution: You request a bridge letter from the provider covering October 1 to December 31 to satisfy your auditor.

Note: Most external auditors will only accept a bridge letter if the gap period is 3 months or less. If the gap is longer, your auditor may flag this as a vendor risk management exception.

How to Request a SOC 2 Bridge Letter from Your Hosting Provider

Securing a bridge letter from major cloud hosting providers is generally straightforward, but it requires knowing where to look or who to contact.

Step-by-Step Guide to Making the Request

Step 1: Identify the Gap Period

Review your own audit window and compare it against your hosting provider's latest SOC 2 Type II report. Calculate the exact start and end dates of the gap you need to cover.

Step 2: Access the Provider’s Compliance Portal

Most tier-one hosting providers offer self-service portals where you can download these letters instantly without needing to contact support:

Amazon Web Services (AWS): Log in to the AWS Management Console and navigate to AWS Artifact.
Microsoft Azure: Access the Service Trust Portal (STP).
Google Cloud Platform (GCP): Use the GCP Compliance Reports Manager.

Step 3: Contact Your Account Representative (If Self-Service is Unavailable)

If you use a managed, private, or smaller niche hosting provider, you will likely need to request the letter manually. Reach out to your Account Manager or Customer Success Representative.

Template: Sample Email to Request a Bridge Letter

If you need to request a bridge letter manually, you can customize the professional template below:

Subject: Request for SOC 2 Bridge Letter - [Your Company Name]

Hi [Account Manager Name],

Our organization is currently preparing for our annual SOC 2 audit. To satisfy our auditors' vendor risk management requirements, we need to review [Hosting Provider Name]’s security coverage for our audit window.

We currently have your latest SOC 2 Type II report covering the period [Start Date] to [End Date]. However, our audit window runs until [Your Audit End Date], leaving a gap of [Number] months.

Could you please provide a SOC 2 Bridge Letter (Gap Letter) signed by management that covers the period from [End Date of Provider's SOC Report] to [Your Audit End Date / Present Date]?

Thank you for your assistance with our compliance efforts.

Best regards,

[Your Name]  
[Your Title]  
[Your Company Name]

How to Analyze a Hosting Provider’s SOC 2 Bridge Letter

Once you receive the letter, do not simply forward it to your auditor. You must perform a brief analysis to verify its validity and ensure it addresses your compliance requirements.

Key Elements to Verify in the Letter

When reviewing the document, ensure the following five elements are present and correct:

Official Management Signature: The letter must be printed on the hosting provider’s official letterhead and signed by an authorized executive (such as the CISO, CTO, or VP of Security).
Specific Dates Covered: The letter must explicitly state the start and end dates of the gap period. Ensure this matches or overlaps with your own audit window.
Reference to the Original Report: The letter must reference the specific SOC 2 Type II report it is bridging, including the name of the CPA firm that performed the original audit.
The "No Material Changes" Statement: Look for a clear statement confirming that there have been no material changes to the provider's control environment, and that controls continue to operate with the same effectiveness outlined in the original report.
Cross-Reference to User Entity Controls: The letter should remind you that the effectiveness of their security still relies on your organization implementing its own Complementary User Entity Controls (CUECs) (e.g., managing your own user access keys on their platform).

Red Flags to Watch Out For

If you spot any of the following issues during your analysis, escalate them immediately with your vendor and alert your compliance team:

The "Material Changes" Disclosure: If the letter states that there have been material changes or control failures since the last audit, you must request details. Your auditors will want to know how those changes impact your data security.
Outdated Signatures: Ensure the letter is recently signed. A bridge letter signed six months ago cannot validate a gap that ends today.
Overextended Gap Coverage: If a hosting provider attempts to issue a bridge letter covering a period longer than 3–4 months, your auditor will likely reject it. In this scenario, ask the provider when their next full SOC 2 Type II report will be published.

Best Practices for Vendor Risk Management and Compliance

Managing SOC 2 reports and bridge letters is an ongoing compliance cycle. To streamline your vendor risk management processes, implement these three best practices:

Create a Compliance Calendar: Track the audit cycles of all your critical subservice organizations. Set reminders 30 days before your audit begins to collect their latest SOC 2 reports or request bridge letters.
Document Your Review: When you analyze a bridge letter, document your sign-off. Keep a brief log stating who reviewed the letter, the date of review, and a confirmation that no material changes were reported. Auditors love to see this proactive oversight.
Map Your User Entity Controls (CUECs): Remember that a hosting provider's security compliance is a shared responsibility. Ensure your team has fully implemented and tested the specific controls your hosting provider expects you to maintain (such as MFA, database encryption, and IAM role restrictions).

[Expert Advice] Telemedicine Ctos Share Top 5 Network Configuration Hacks For Zero Packet Loss