What is the difference between carve-out and inclusive method in SOC 2?

Both methods are ways a SOC 2 report treats a subservice organization such as a cloud host. Under carve-out, the report describes the vendor and the controls the company expects it to operate, but the CPA firm does not test them. Under the inclusive method, the vendor's controls are part of the description and are tested, and the vendor's own management also signs an assertion. Compass IT Compliance and TCSA describe it this way, and Linford & Co. agrees on the testing difference.

What is a subservice organization in a SOC 2 report?

A vendor whose controls are needed, together with the service organization's own, to meet the commitments the report covers. Compass gives cloud hosts, data centers, payroll processors and managed service providers as examples, and says office suppliers, non-integrated SaaS tools and legal counsel do not qualify. That is why a company's vendor inventory is usually longer than the subservice organizations in its report.

What are CSOCs, and how are they different from CUECs?

Complementary subservice organization controls (CSOCs) are controls the service organization expects its own subservice organization to operate. Complementary user entity controls (CUECs) are controls it expects you, its customer, to operate. Compass says that under carve-out the CSOCs are a disclosure and the CPA firm does not test them. The CUEC guide on this site covers the other list.

Is a cloud host usually carved out?

The sources say yes. TCSA says hyperscale cloud providers are typically carved out, and Compass says major cloud providers typically will not take part in an inclusive examination. Neither claim tells you what a given vendor's report does, so read the report in front of you. This page does not say which method any named provider's customers use.

Does carve-out mean the cloud host's controls were never tested?

No. It means they were not tested in this report. Scytale warns that carve-out does not mean you exclude the services and carry on, and Compass advises customers to get the subservice organization's own SOC report and check that it addresses the controls the vendor assumed. If the host has no report, the assurance has to come from somewhere else, such as direct testing.

Can one SOC 2 report use both methods?

TCSA says management picks the method separately for each subservice organization, so one report can carve out the cloud host and include a closely owned affiliate. We found that point in one source only, so confirm it with your CPA firm if your report would mix the two.

Which method should a startup choose for its first SOC 2 report?

Most startups have no real choice for their cloud host, because inclusive needs the vendor to cooperate and sign its own assertion. TCSA makes that the key question. Start with carve-out for hosting and similar vendors that publish their own report, write specific CSOCs, and keep a vendor review on file for each one. Raise the inclusive method with your CPA firm only for a vendor that will sign and that has no report of its own.

Carve-out vs inclusive method in a SOC 2 report

Updated 25 October 2026

Carve-out and inclusive are the two ways a SOC 2 report treats a subservice organization, such as the cloud host the system runs on. With carve-out, the report names the vendor and lists the controls the company expects it to operate, but the CPA firm does not test them. With the inclusive method, the vendor's controls are described and tested in the same report, and the vendor's management signs its own assertion. Carve-out is the more common choice, and the controls it leaves untested are called CSOCs. If you read a vendor's report, carve-out means you still need the host's own assurance. If you are writing your own, it means deciding the method for each vendor and keeping evidence that you watch the ones you carve out.

What a subservice organization is

A SOC 2 report is written by a licensed CPA firm after it examines a service organization's controls against the Trust Services Criteria. Few startups run everything themselves. A subservice organization is a vendor whose services are part of that system and whose controls the service organization needs in order to meet its commitments. Compass IT Compliance lists cloud hosts, data centers, payroll processors and managed service providers as examples (Compass). TCSA stresses the word "necessary": that is what separates a subservice organization from an ordinary vendor (TCSA).

So not every vendor in your inventory belongs in the report. Compass names office suppliers, non-integrated SaaS tools and legal counsel as vendors that do not qualify (Compass). The AICPA, which publishes the SOC 2 guidance, lists "inclusive versus carve-out methods of reporting on controls at subservice organizations" as a topic of its SOC 2 report walkthrough course (AICPA). The AICPA pages we could open describe the topic but do not reproduce the requirements, which sit in paid publications, so the detail below comes from practitioner sources.

The two methods side by side

Carve-out	Inclusive
Testing: the vendor's controls are described but not tested. The opinion covers the service organization's own controls (Compass).	Testing: controls are tested at both organizations and the opinion covers both (Compass).
Assertions: only your management asserts, with one representation letter (TCSA).	Assertions: the vendor's management also signs an assertion and gives representations (TCSA) (Linford).
Vendor effort: none needed. Each party keeps its own scope and timeline (Compass).	Vendor effort: it must agree to take part, give the auditor access and share responsibility for the combined description (Compass).
Reader's job: obtain the vendor's own SOC report or other assurance (Compass).	Reader's job: read one report that tests both. Linford calls it a stronger report (Linford).
How common: the more common method (Compass) (Scytale).	How common: not commonly used (Strike Graph), rarely the default (Compass).

The choice is not the CPA firm's alone to impose and not the vendor's to demand. TCSA says management makes it for each subservice organization, and the CPA firm then examines the description and controls as presented (TCSA). Linford's article is from 2021, so check any detail you rely on against your own CPA firm.

What carve-out still requires: CSOCs and monitoring

Carve-out is not an exemption. The report still has to describe the carved-out vendor. Compass says the description names the vendor, describes the services it provides and states which types of controls are excluded, and the auditor's report says the opinion does not extend to them (Compass). The controls the service organization expects the vendor to operate are the complementary subservice organization controls (CSOCs). Compass describes them as a disclosure requirement and not a tested assertion: the company represents that it has a basis to expect them, and the CPA firm does not test them (Compass).

Strike Graph's help center gives the practical shape. The company writes its own CSOC section, drawing the control detail from each subservice organization's SOC 2 report, and its examples include physical access controls (criterion CC6.4) performed by a cloud host (Strike Graph). TCSA adds a second point: the controls the company uses to monitor the vendor are part of what the CPA firm tests, and vendor management (CC9.2) still applies (TCSA). Compass does not mention the monitoring controls, so treat that as one source's reading of the description criteria and confirm it with your CPA firm.

CSOCs are a different list from CUECs. CSOCs name what the vendor's own vendors do; CUECs name what you must do. The CUEC guide covers the second list.

Where the sources disagree or go quiet

When inclusive makes sense. Linford says it suits subservice organizations that have no SOC report or other assurance of their own, and that it is easier between related parties (Linford). Scytale takes the opposite angle: when the vendor's own report already covers the services you use, you can be reasonably confident you do not need inclusive (Scytale). Compass and TCSA add that large cloud providers typically will not participate (Compass) (TCSA).
Mixing methods. Only TCSA says one report can use both, one per vendor (TCSA).
Standards references. TCSA ties both methods to the description criteria (DC section 200). We could not open the full AICPA text, so we do not cite section numbers as settled.
Vague CSOCs. Compass says vague CSOCs are common and leave readers unsure what the vendor was assumed to do, and that assurance breaks down when a subservice organization has no SOC coverage (Compass).

If you are reading a vendor's report

Find the subservice section of the system description (the heading may read "Complementary Subservice Organization Controls", as TCSA notes (TCSA)), then work through this:

List each subservice organization and its method. Carved out or included, one line per vendor.
For each carved-out vendor, ask for its report. Compass advises getting the subservice organization's report for the relevant period and confirming that it addresses the CSOCs (Compass). Compass also suggests a bridge letter if that report does not cover the full period; see the bridge letter template for what such a letter is and is not.
Check the CSOCs are specific. A CSOC that only says the host "provides a secure environment" cannot be mapped to anything.
Compare with the sub-processor list. TCSA says the carve-out list and the sub-processor list use different tests, so a vendor can appear on one and not the other (TCSA).
Record the result. Note the gap if a carved-out vendor has no report. Compass says direct testing is the next step when no report exists or the report has relevant exceptions (Compass).

The rest of the report review (opinion, period, scope, exceptions) is in how to read a SOC 2 report, which takes the carve-out distinction from one source. This page adds the others. To find the hosting provider's report in the first place, see where to get your vendors' SOC 2 reports.

What the generated vendor policy says

The Vendor and Third-Party Risk Management Policy does not use the words carve-out or inclusive. It asks the Security Owner to review an independent assurance report for Tier 1 vendors and to document sub-processors, which is where the subservice question lands. The statements below are rendered from the policy template for the Northwind Cloud Inc sample intake, so they change when the template does.

Section 4.3: For Tier 1 vendors, the Security Owner reviews an independent assurance report covering the service used, records exceptions and the complementary user entity controls Northwind Cloud Inc must operate, and documents the data flow and sub-processors.

Section 4.8: Every Tier 1 and Tier 2 vendor is reviewed at least annually to confirm the service, data and tier are still accurate, obtain the current assurance report, check incidents and material changes, confirm contract terms, and decide whether the relationship continues, changes or ends.

Our recommendation, not a requirement of the policy or the criteria: in each Tier 1 vendor review, add a line for the vendor's subservice organizations and whether each is carved out or included. That is the evidence behind criterion CC9.2 when an auditor asks how you rely on a host whose controls are carved out of its report. The free vendor review template builds one draft record per vendor you name.

If you are writing your own report

Your system description has to name your subservice organizations and say how you treat each. The free system description template drafts that section as a table of organization, service, method and controls expected of it, and leaves the method as a placeholder. Decide it like this:

Apply the necessity test. Keep only vendors whose controls you need to meet your commitments. Production hosting nearly always qualifies; a design tool does not. Leave the rest in your vendor inventory.
Ask whether the vendor would sign. TCSA says this decides the matter: if the vendor will not sign its own assertion, inclusive is unavailable (TCSA). Inclusive also needs a CPA firm independent of both parties, per the same source.
Expect carve-out for a large cloud host. Both Compass and TCSA say these providers are typically carved out or will not participate. Inclusive is realistic mainly for group-owned data centers and captive delivery entities (TCSA).
Write specific CSOCs. Name the criterion and the control you expect the vendor to operate, and copy it from the vendor's own report where you can, as Strike Graph describes (Strike Graph).
Keep evidence that you monitor each carved-out vendor. That means the report you obtained, who reviewed it, the date, the exceptions you noted and what you did about them. Do this every year, as the vendor policy's annual review does.
Agree the method with your CPA firm early. The firm forms its own opinion on your description, so settle the treatment of each vendor before fieldwork.

Customers reading your report will run the checklist above. A host that publishes its own report makes carve-out easy to defend; a vendor with none makes it hard. The Audit Kit ($59, one time) includes vendor review records and a first draft of the system description, with the subservice table and its placeholders for you to fill. The report itself comes only from a CPA firm.

Frequently asked questions

What is the difference between carve-out and inclusive method in SOC 2?: Both methods are ways a SOC 2 report treats a subservice organization such as a cloud host. Under carve-out, the report describes the vendor and the controls the company expects it to operate, but the CPA firm does not test them. Under the inclusive method, the vendor's controls are part of the description and are tested, and the vendor's own management also signs an assertion. Compass IT Compliance and TCSA describe it this way, and Linford & Co. agrees on the testing difference.
What is a subservice organization in a SOC 2 report?: A vendor whose controls are needed, together with the service organization's own, to meet the commitments the report covers. Compass gives cloud hosts, data centers, payroll processors and managed service providers as examples, and says office suppliers, non-integrated SaaS tools and legal counsel do not qualify. That is why a company's vendor inventory is usually longer than the subservice organizations in its report.
What are CSOCs, and how are they different from CUECs?: Complementary subservice organization controls (CSOCs) are controls the service organization expects its own subservice organization to operate. Complementary user entity controls (CUECs) are controls it expects you, its customer, to operate. Compass says that under carve-out the CSOCs are a disclosure and the CPA firm does not test them. The CUEC guide on this site covers the other list.
Is a cloud host usually carved out?: The sources say yes. TCSA says hyperscale cloud providers are typically carved out, and Compass says major cloud providers typically will not take part in an inclusive examination. Neither claim tells you what a given vendor's report does, so read the report in front of you. This page does not say which method any named provider's customers use.
Does carve-out mean the cloud host's controls were never tested?: No. It means they were not tested in this report. Scytale warns that carve-out does not mean you exclude the services and carry on, and Compass advises customers to get the subservice organization's own SOC report and check that it addresses the controls the vendor assumed. If the host has no report, the assurance has to come from somewhere else, such as direct testing.
Can one SOC 2 report use both methods?: TCSA says management picks the method separately for each subservice organization, so one report can carve out the cloud host and include a closely owned affiliate. We found that point in one source only, so confirm it with your CPA firm if your report would mix the two.
Which method should a startup choose for its first SOC 2 report?: Most startups have no real choice for their cloud host, because inclusive needs the vendor to cooperate and sign its own assertion. TCSA makes that the key question. Start with carve-out for hosting and similar vendors that publish their own report, write specific CSOCs, and keep a vendor review on file for each one. Raise the inclusive method with your CPA firm only for a vendor that will sign and that has no report of its own.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.