SOC 2 bridge letters: what they cover and when customers accept them
A bridge letter covers the gap between the end of your last SOC 2 period and your next report. Customers usually accept one for a few months, not longer.
SOC 2
Trust Services Criteria, report types, bridge letters, subservice organisations and running a SOC 2 programme.
Implementing it? See SOC 2 on QULDEX.
Evidence management
An audit evidence naming convention that survives three audits
Evidence that cannot be found, dated or traced to a control gets requested again. A five-part file name fixes most of that before any tool is involved.
SOC 2
How long should your first SOC 2 Type 2 observation window be?
Three, six or twelve months: the right first observation window depends on how long your controls have run, what your buyers will accept and when you need the report.