What is a SOC 2 bridge letter, who issues it, and what assurance does it give an enterprise customer?

## The problem a bridge letter solves A **SOC 2 Type II** report gives an opinion on controls **throughout a specified period** — say 1 January to 31 December. The report is issued some weeks after that period ends. A customer's procurement team reviewing the vendor in June is looking at an opinion about last year, with a gap of about six months in which nothing has been examined. A **bridge letter** (often called a **gap letter**) is the conventional way to cover that gap until the next report is issued. ## Who issues it The **service organization's management** writes and signs it. The **service auditor** does not issue it, has not tested the gap period, and gives no opinion on it. This is the most important fact about a bridge letter: it is a **representation**, not an attestation. ## What it usually contains | Element | Purpose | |---|---| | Reference to the last report | Type, categories, period and auditor | | Gap period covered | From the day after the period end to the letter date | | Statement on system changes | No material changes to the system description, or a description of them | | Statement on controls | No known significant deficiencies or failures, or a disclosure of them | | Statement on incidents | No known security incidents affecting the system, or a disclosure | | Next report | Expected period and issue date | | Signature | An officer of the service organization | ## How much weight it carries - It relies on management's honesty and knowledge, not on testing. - It is usually accepted for a **limited gap**, commonly up to around three months, and customers often question longer ones. - It cannot cure a gap in the **coverage periods** between two reports: if one period ended in June and the next starts in October, those months were never examined, and the bridge letter only asserts about the time since the last report. - A letter disclosing **material changes** — a new hosting provider, a re-architected authentication system, a significant incident — is a signal to ask for more evidence rather than to file it. ## A B2B SaaS vendor's example The vendor's last Type II covered 1 January to 31 December and was issued in February. In May an enterprise customer's procurement team asks for assurance. 1. The vendor provides the Type II report under NDA. 2. It provides a bridge letter covering 1 January to 30 April, signed by its chief technology officer, stating no material changes to the system description, no known control failures, one low-severity incident handled under its incident procedure, and that the next report will cover the current calendar year. 3. The procurement team accepts it, notes the incident for follow-up, and diarises the next report. ## What a customer should check - The letter refers to the correct report and period. - The gap is short enough to be credible. - Changes and incidents are disclosed rather than silently absent. - The signer has authority over the controls. - The next report's period starts where the last one ended. ## Misreadings - "The auditor signed off the gap" — the auditor did not. - "A bridge letter extends the report's validity" — SOC 2 reports have no validity term; the letter only adds management's word for the gap. - "One bridge letter can cover a year" — at that length it is a substitute for an examination, and customers should treat it as such.