Are contractors in scope for SOC 2?

Some are. Drata says a contractor is in scope for a SOC 2 report if they have an effect on the system being audited, and Secureframe's test is whether the contractor has access to customer data. Both say the decision is up to your auditor, so write down who you included and why.

Do contractors need background checks?

The sources give no single rule. The generated Human Resources Security Policy applies the same screening requirement to contractors with access, and where an agency does the screening it asks for written confirmation that the check is equivalent. The background checks guide covers the evidence and the legal limits.

Can contractors use personal devices?

SOC 2 names no rule against it. Vanta says scoped personnel are subject to the same device compliance as employees, so a personal laptop that reaches in-scope systems needs the same checks as a company one: disk encryption, screen lock and updates. OneUptime lists approved systems and devices among the terms a contract should cover. See the MDM guide for ways to show device state without a tool.

What about a contractor with no system access?

Secureframe's example is a freelance designer who handles branding work and has no access to sensitive information: out of scope. Drata adds one check, which is whether the person's work affects the business objectives or customer commitments in the audit. If it does not, record that answer and move on.

Is a signed contract enough evidence?

No. OneUptime puts it as "a contract clause is not evidence that the process operated". Keep the approval, the account creation, the policy acknowledgment, the training record and the date access ended.

SOC 2 for contractors and freelancers: who is in scope

Updated 27 October 2026

A contractor is in scope for SOC 2 when they can reach customer data or affect the system being examined, not because of their title or how they are paid. A DevOps contractor with production access is in; a freelance designer with no access is out. This guide gives three questions to ask about each person, the controls a scoped contractor needs, contract terms worth having and the record that shows the process ran. The sources are vendors, so your CPA firm has the final say.

Short answer: scope follows access and impact

Vanta says scoping "starts with access, not job titles" and that contractors, vendors and temporary workers with system access belong in the population (Vanta). Secureframe quotes one of its compliance experts: the scope of a SOC 2 relates to customer data, so the key question is whether the contractor has access to it (Secureframe). Drata says the decision is up to your auditor (Drata). OneUptime adds that SOC 2 does not require every worker to be an employee (OneUptime).

Three questions to ask about each contractor

Drata's test is whether a contractor has an effect on the system being audited. It breaks that into questions (Drata):

Does the contractor interact with any customer data?
Does the contractor support the system being audited?
If neither, does their work affect the business objectives or customer commitments in the audit?

Example	Likely answer	Source
DevOps contractor with access to company or customer data	In scope	(Secureframe) (Drata)
Security consultant who writes policies and risk assessments	May be in scope through business objectives	(Drata)
Freelance designer on branding, no access to sensitive information	Out of scope	(Secureframe)

Most people at a small company sit in the first or third row. The second is the one to discuss with your CPA firm.

Controls for a scoped contractor

Vanta says scoped personnel are subject to the same onboarding, access management, policy acknowledgment and training as employees, with consistent device compliance (Vanta). Item 4.9 of the generated Human Resources Security Policy writes that down:

Contractors, agency workers and vendor staff with access to Northwind Cloud Inc systems meet the same screening, acknowledgment, training and offboarding requirements as employees. Where the contracting entity performs screening, Northwind Cloud Inc obtains written confirmation that it is equivalent to Section 4.1.

The same policy gives a contractor lifecycle in item 5.9, including an end date after which access expires:

Contractor lifecycle. Before a contractor receives access, People Operations confirms a signed services agreement with confidentiality terms, screening confirmation and policy acknowledgment, and records a contract end date on which access expires unless the engaging manager confirms an extension in writing. Owner: People Operations, with the engaging manager. Cadence: at engagement and on each extension.

The onboarding and offboarding checklist works for contractors too, and the training page and acknowledgment guide cover the other two items. For screening, see background checks.

Agencies and offshore partners

OneUptime says the workforce population should include everyone who can affect the in-scope system: employees, independent contractors, agency personnel and vendor administrators (OneUptime). So each agency person with an account is in scope as a person, and the agency itself may also belong in your vendor review. Whether a vendor is examined as a vendor or alongside your system is a separate question, covered in the carve-out vs inclusive guide.

Contract terms worth having

OneUptime lists obligations a contractor or staffing agreement should address (OneUptime):

Confidentiality and acceptable use, plus security and privacy requirements
Approved systems, devices and work locations
Incident and lost-device reporting
Return or deletion of company data and assets
Use of subcontractors
Screening, where selected and lawful
Access termination and cooperation at offboarding

It also says legal counsel should adapt the terms to worker classification, labor, privacy and cross-border rules. A clause is a promise; the next section is the proof.

The evidence chain for one contractor

OneUptime says a contract clause is not evidence that the process operated, and lists what to keep: onboarding approval, identity provisioning, device posture, training, access reviews and termination events (OneUptime). For one contractor over an observation period that is the approval, the account creation date, the signed acknowledgment, the training completion, each access review they appeared in, and the date their access ended. Run the mock audit to see which of these you can produce today.

Write down the decision and revisit it

Vanta recommends reviewing scope periodically and involving security, engineering, HR and legal (Vanta). Drata says your explanation of why a contractor is or is not in scope matters (Drata). A short list with a name, a role, the answer to the three questions and a date is enough, and the reasons to update it are a new project, a new tool or the end of an engagement. See SOC 2 scope for the system-level decision, and CC6.2 and CC1.4 for the criteria that cover provisioning access and a competent workforce.

Frequently asked questions

Are contractors in scope for SOC 2?: Some are. Drata says a contractor is in scope for a SOC 2 report if they have an effect on the system being audited, and Secureframe's test is whether the contractor has access to customer data. Both say the decision is up to your auditor, so write down who you included and why.
Do contractors need background checks?: The sources give no single rule. The generated Human Resources Security Policy applies the same screening requirement to contractors with access, and where an agency does the screening it asks for written confirmation that the check is equivalent. The background checks guide covers the evidence and the legal limits.
Can contractors use personal devices?: SOC 2 names no rule against it. Vanta says scoped personnel are subject to the same device compliance as employees, so a personal laptop that reaches in-scope systems needs the same checks as a company one: disk encryption, screen lock and updates. OneUptime lists approved systems and devices among the terms a contract should cover. See the MDM guide for ways to show device state without a tool.
What about a contractor with no system access?: Secureframe's example is a freelance designer who handles branding work and has no access to sensitive information: out of scope. Drata adds one check, which is whether the person's work affects the business objectives or customer commitments in the audit. If it does not, record that answer and move on.
Is a signed contract enough evidence?: No. OneUptime puts it as "a contract clause is not evidence that the process operated". Keep the approval, the account creation, the policy acknowledgment, the training record and the date access ended.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.