Short answer
A SOC 2 bridge letter, also called a gap letter, is a statement from a service organisation's management covering the period between the end of its latest SOC 2 report and the date of the letter. It confirms there have been no material changes to the system or controls. It is not audited, so customers usually accept one only for a gap of up to about three months.
Key takeaways
- Management writes and signs the bridge letter; the auditor does not.
- It covers the gap between the report period end and today, not the future.
- Most customers accept a gap of up to about three months.
- Continuous, back-to-back report periods keep bridge letters short.
What a bridge letter is, and is not
| SOC 2 Type 2 report | Bridge letter | |
|---|---|---|
| Written by | Independent CPA firm | Your management |
| Assurance | Audited opinion | Management's representation only |
| Period | The observation window | End of the window to the letter's date |
| Customer weight | Primary evidence | Stopgap until the next report |
What to include
Checklist
Bridge letter contents
0 of 7 done
When customers accept one
Customers use your SOC 2 report to rely on your controls for their own audits. The further the letter stretches from the end of your last audited period, the less weight it carries. Most procurement and audit teams accept a bridge letter for up to about three months; beyond that, expect questions or a request for the next report.
Avoiding long gaps
Gaps grow when a new observation window starts weeks after the last one ended. Start each window the day after the previous one closes and keep it twelve months long; then the only gap customers see is the few weeks the auditor needs to issue the report, which a short bridge letter covers.
If a material change did occur, for example a new cloud provider or a major incident, say so in the letter. An honest letter keeps customer trust; a letter later contradicted by your next report does not.
Frequently asked questions
Who signs a SOC 2 bridge letter?
The service organisation's management, usually an accountable officer. The audit firm does not sign or audit it.
How long can a SOC 2 bridge letter cover?
There is no fixed rule, but most customers accept a bridge letter for a gap of up to about three months after the end of the latest SOC 2 period.