If we host on AWS, are we covered for SOC 2?

No. Linford says using AWS does not automatically give your organization a SOC 2 report: AWS's own report covers AWS's controls, and yours covers the controls your company runs. TCSA describes a provider's report as an examination of that provider's controls over that provider's system. You still need your own policies, evidence and a report from a CPA firm.

Do Azure and Google Cloud work the same way?

The logic TCSA describes is about any cloud provider, not AWS alone: the provider's report covers its side and the customer keeps the controls inside its own tenancy. Neither source we fetched reads the Azure or Google Cloud reports, so check each provider's own report for what it covers and which complementary user entity controls it lists.

Does the AWS report make our audit shorter or cheaper?

Linford, a CPA firm, says the number of applicable controls in your report will be smaller than if you ran the infrastructure yourself, and that you should see a saving on fees. That is one firm's statement and no figure is given. Your CPA firm's quote is the number that counts.

Can we send our auditor AWS's SOC 3 report or a trust page instead?

TCSA says auditors want the provider's full SOC 2 Type 2 report, with the opinion, system description and test results, and that a SOC 3, a trust center page or a badge is not accepted. That is one firm's account of what auditors ask for. Ask your CPA firm what it expects.

What do we have to do about the AWS report?

Keep a record that someone read it. TCSA lists a register of providers, the full report, a dated review record (reviewer, report period, exceptions, complementary user entity controls and a conclusion), a comparison of the report's period with your observation period, and evidence that you operate each control the report assumes of you. Linford says your monitoring of the provider should include obtaining its SOC reports and reviewing the controls and test results in them.

What if a provider has no SOC report?

Linford suggests alternatives such as reconciling outputs, discussions, site visits or internal audit testing. The generated Vendor Policy accepts a completed questionnaire for Tier 2 vendors but asks for an assurance report for Tier 1. A cloud host is usually Tier 1, so a provider with no report is a risk to record and decide on, not skip.

Does AWS's SOC 2 cover your company?

Updated 1 November 2026

No. A cloud provider's SOC 2 report is an examination of that provider's controls over its own system (TCSA). Your report covers the controls your company runs, and AWS's controls are carved out of it (Linford). What you still own is everything you configure and decide inside your account, and what you owe the auditor about AWS is a dated record that you read its report. This page lists what stays with you, what the auditor asks for, and the record to keep. Both sources are practitioner firms, not the AICPA, so confirm the details with your CPA firm.

What the provider's report covers, and what yours covers

Linford puts it plainly: your report "will not include the controls that are AWS's responsibility," because those are carved out, and you remain responsible for "the security of what you put in the cloud" (Linford). TCSA says the provider becomes a carved-out subservice organization in your report, and that the provider's report contains no testing of your configuration, access decisions, development process or data handling (TCSA). For how a carve-out is written up, see the carve-out vs inclusive method guide.

What stays with you

TCSA splits the work by domain. The provider covers the infrastructure layer; you keep these (TCSA):

Domain	What you still run (TCSA)	Where to start
Identity and access	Account provisioning, privilege levels, access reviews, removals	Access review sheet
Encryption and keys	Whether encryption is on for your resources, key policies, rotation, TLS enforcement	Encryption guide
Network configuration	Security groups, ingress rules, public exposure, WAF rules	Network policy
Logging and monitoring	Turning logs on in every region and account, alert handling, follow-up	Logging guide
Vulnerabilities and patching	Guest OS, container images, dependencies, scan cadence, remediation	Scanning frequency guide
Backup and restore	Configuration, retention, and whether restores were tested	Restore test log
Change management	Peer review, approval, separating author from deployer	Change request form
Personnel	Screening, training and offboarding for staff and contractors with admin access	Offboarding checklist

Linford adds that AWS is not responsible for configuring the inbound and outbound security rules of your virtual machines (Linford). The provider's report also lists complementary user entity controls, the controls it assumes you operate; TCSA says to extract each one, assign an owner and generate evidence (TCSA). The CUEC guide shows how.

What the auditor asks about the provider's report

TCSA lists five things an auditor expects to see (TCSA):

A register of each provider, the service it performs, whether its controls are necessary to your commitments, and who reviews it.
The provider's full SOC 2 Type 2 report: opinion, system description and test results. TCSA says a SOC 3, a trust center page or a badge is not accepted.
A dated review record: who reviewed the report, the period, exceptions, complementary user entity controls and the conclusion. A stored PDF alone is not enough.
A comparison of your observation period with each provider report period, with any gap covered by a bridge letter, a continued-operations letter or documented risk acceptance. See the bridge letter template.
Evidence that you operate each complementary user entity control, drawn from system-of-record populations the auditor can sample.

Linford asks for the same monitoring in its own words: obtain the provider's SOC reports and review the controls and the results of control testing in them (Linford). Where no SOC report exists, it lists alternatives such as reconciling outputs, discussions, site visits or internal audit testing. Ask your CPA firm which of these it will accept.

What the generated policy says

The generated Vendor and Third-Party Risk Management Policy turns this into commitments. These are Policyseed's defaults, not requirements of the criteria:

For Tier 1 vendors, the Security Owner reviews an independent assurance report covering the service used, records exceptions and the complementary user entity controls Northwind Cloud Inc must operate, and documents the data flow and sub-processors.
Vendor and Third-Party Risk Management Policy, item 4.3

Due diligence. For Tier 1 vendors, the Security Owner obtains the current SOC 2 Type II report or ISO 27001 certificate, reviews scope, opinion, exceptions and complementary user entity controls, sends the Northwind Cloud Inc questionnaire where gaps remain and documents the data flow with Engineering; Tier 2 vendors need an assurance report or completed questionnaire. Findings and the final tier are recorded.
Vendor and Third-Party Risk Management Policy, item 5.2

Every Tier 1 and Tier 2 vendor is reviewed at least annually to confirm the service, data and tier are still accurate, obtain the current assurance report, check incidents and material changes, confirm contract terms, and decide whether the relationship continues, changes or ends.
Vendor and Third-Party Risk Management Policy, item 4.8

The tiers, the inventory and the annual review are laid out in SOC 2 vendor management, and where to find the reports in where to get your vendors' SOC 2 reports. The vendor review template holds the dated record.

Where the sources are thin

Dates. TCSA's page says it was last reviewed in August 2026. Linford's page shows "Published April 2, 2025" in the byline and "updated on 3/26/25" in a closing note, so the two dates disagree. We cite its text and not its date.
Fees and scope. Linford sells SOC 2 audits and says you should receive a saving on fees because fewer controls are in scope. It gives no figure, and we print none.
Other providers. Neither source reads the Azure or Google Cloud reports. The structure above is TCSA's general description of provider reports.

Frequently asked questions

If we host on AWS, are we covered for SOC 2?: No. Linford says using AWS does not automatically give your organization a SOC 2 report: AWS's own report covers AWS's controls, and yours covers the controls your company runs. TCSA describes a provider's report as an examination of that provider's controls over that provider's system. You still need your own policies, evidence and a report from a CPA firm.
Do Azure and Google Cloud work the same way?: The logic TCSA describes is about any cloud provider, not AWS alone: the provider's report covers its side and the customer keeps the controls inside its own tenancy. Neither source we fetched reads the Azure or Google Cloud reports, so check each provider's own report for what it covers and which complementary user entity controls it lists.
Does the AWS report make our audit shorter or cheaper?: Linford, a CPA firm, says the number of applicable controls in your report will be smaller than if you ran the infrastructure yourself, and that you should see a saving on fees. That is one firm's statement and no figure is given. Your CPA firm's quote is the number that counts.
Can we send our auditor AWS's SOC 3 report or a trust page instead?: TCSA says auditors want the provider's full SOC 2 Type 2 report, with the opinion, system description and test results, and that a SOC 3, a trust center page or a badge is not accepted. That is one firm's account of what auditors ask for. Ask your CPA firm what it expects.
What do we have to do about the AWS report?: Keep a record that someone read it. TCSA lists a register of providers, the full report, a dated review record (reviewer, report period, exceptions, complementary user entity controls and a conclusion), a comparison of the report's period with your observation period, and evidence that you operate each control the report assumes of you. Linford says your monitoring of the provider should include obtaining its SOC reports and reviewing the controls and test results in them.
What if a provider has no SOC report?: Linford suggests alternatives such as reconciling outputs, discussions, site visits or internal audit testing. The generated Vendor Policy accepts a completed questionnaire for Tier 2 vendors but asks for an assurance report for Tier 1. A cloud host is usually Tier 1, so a provider with no report is a risk to record and decide on, not skip.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.