What does SOC 2 require for vendor management?

Criterion CC9.2 reads: "The entity assesses and manages risks associated with vendors and business partners." Linford & Co. and Vanta both quote it that way. The criterion does not prescribe steps. Linford says the points of focus beneath it are examples and not all of them apply to every company. In practice that means a vendor inventory, a way to assess each vendor, and dated records that you did.

Do I need a SOC 2 report from every vendor?

Neither Linford nor Vanta says so. Linford lists reviewing a vendor's latest SOC 1 or SOC 2 report as one typical activity, and Vanta treats the report as a useful input. Which vendors you review, and how, is your risk decision, and your CPA firm judges whether the evidence supports it. What you keep is the review record: who looked at what, when, and what you decided. The generated Vendor Policy asks for an independent assurance report only for Tier 1 vendors.

How often should I review vendors for SOC 2?

Linford's wording is "at least annually", scaled to risk: more often for a riskier vendor. Vanta gives no fixed interval and says compliance with commitments is assessed periodically. The generated Vendor Policy reviews Tier 1 and Tier 2 vendors at least annually and Tier 3 vendors every two years or when their use changes. That default is Policyseed's, not a requirement of the criteria.

Is a vendor security questionnaire enough?

The sources do not say a questionnaire is or is not enough. Linford and Vanta both describe periodic security reviews as the activity, with a SOC report as one input. For a vendor with no report, a completed questionnaire plus contract terms is a common fallback, and the generated Vendor Policy accepts an assurance report or a completed questionnaire for Tier 2. Whether it satisfies your auditor is the CPA firm's call.

Are AI tools vendors under CC9.2?

If a tool receives company or customer data or connects to your accounts, treat it as a vendor: put it in the inventory, tier it, and record the data terms you accepted. The generated Vendor Policy applies the same rule to free, trial and personal-account services and to AI services connected to company accounts. Neither fetched source discusses AI tools, so this is our reading, not theirs.

What is the difference between a vendor and a subservice organization?

A subservice organization is a vendor whose controls are needed, together with yours, to meet the commitments in your report, such as the cloud host. Most vendors are not subservice organizations. The subservice organizations appear in your system description and are carved out or included; every vendor falls under CC9.2. The carve-out guide on this site covers the distinction.

SOC 2 vendor management: what CC9.2 requires

Updated 29 October 2026

SOC 2 asks for vendor management in one sentence. Criterion CC9.2 reads "The entity assesses and manages risks associated with vendors and business partners," and both sources we read quote it that way (Linford) (Vanta). It does not say how, and it does not say every vendor needs a SOC report. What a small team can defend is a vendor inventory, a tier for each vendor, a review scaled to the tier (at least annually for the vendors that matter), and a dated record of each review. The rest of this page shows what the sources list, where they are silent, and one tiered process you can adopt.

What the criterion says, and what it leaves open

CC9.2 sits in the risk mitigation group of the Common Criteria. Linford & Co. lists 13 points of focus under it, from establishing requirements for vendor engagements to terminating relationships, and says the points are examples that may or may not apply to a given company (Linford). Two of them apply only if you add the Confidentiality or Privacy criteria. Points of focus are not a checklist the auditor ticks; your CPA firm decides what evidence fits your vendors and your commitments. If the sources disagree with your CPA firm, your CPA firm wins.

What the sources describe as typical activity

Know the vendors. Linford describes vetting each vendor's data access when you onboard it and tracking vendors in one place (Linford).
Have an onboarding procedure. Vanta lists clear policies and procedures for onboarding new vendors and partners (Vanta).
Put security terms in contracts. Linford includes contract terms for termination, with data return or deletion (Linford).
Review periodically. Linford lists reviewing the vendor's most current SOC 1 or SOC 2 report, performing periodic security reviews and risk assessments, and monitoring performance against SLAs (Linford). Vanta lists ongoing due diligence and regular review of providers' security practices (Vanta).
Handle problems and exits. Linford's points of focus include procedures for issues found in assessments and for ending a relationship (Linford).

Both companies sell compliance software or services, so read their lists as descriptions, not as requirements. Vanta's page is undated; Linford's is from 31 July 2024.

Do you need a SOC report from every vendor?

No source we read says so. Linford presents report review as one typical activity among several (Linford), and Vanta presents a vendor's report as useful to the customer reading it, noting that such reports are usually valid for 12 months (Vanta). Many small vendors have no report at all. The defensible position is to decide, in writing, what assurance each tier needs, and keep the review record whether or not a report exists. The evidence is the review, not the report itself. For where to find the reports that do exist, see where to get your vendors' SOC 2 reports, and for reading one, how to read a SOC 2 report.

A tiered review a small team can run

Linford says assessment frequency should follow risk, with a baseline of at least annually (Linford); Vanta gives no interval (Vanta). The generated Vendor and Third-Party Risk Management Policy turns that into three tiers. This is Policyseed's default, one example of a process, not the only one the criteria allow.

Tier	Who is in it	Minimum due diligence	Review
Tier 1, critical	Stores or processes customer data, or a Tier 1 system depends on it (hosting, source control, identity provider)	Independent assurance report reviewed, data flow and sub-processors documented, contract security terms	At least annually
Tier 2, important	Internal confidential or personnel data, or access to internal systems, but no customer data	Assurance report or completed questionnaire, contract security terms	At least annually
Tier 3, low	No access to confidential data or systems	Tier confirmed by the Security Owner, standard terms	Every two years or when use changes

The statements below are rendered from the policy template for the Northwind Cloud Inc sample intake, so they change when the template does.

Section 4.1: Northwind Cloud Inc maintains a vendor inventory recording, for every vendor, the business owner, service provided, data shared and its classification, systems accessed, tier, contract and renewal date, last review date and outcome, and assurance evidence held, and reviews it for completeness at least annually.

Section 4.2: No vendor receives Northwind Cloud Inc data, system access or a connection to Northwind Cloud Inc accounts until it is in the inventory, tiered by the Security Owner and cleared through the due diligence for its tier. Free, trial and personal-account services follow the same rule.

Section 4.3: For Tier 1 vendors, the Security Owner reviews an independent assurance report covering the service used, records exceptions and the complementary user entity controls Northwind Cloud Inc must operate, and documents the data flow and sub-processors.

Section 4.8: Every Tier 1 and Tier 2 vendor is reviewed at least annually to confirm the service, data and tier are still accurate, obtain the current assurance report, check incidents and material changes, confirm contract terms, and decide whether the relationship continues, changes or ends.

The evidence to keep

The inventory, with owner, data shared, tier, contract renewal date and last review date. The free vendor review template builds one draft record per vendor you name.
One dated review record per Tier 1 and Tier 2 vendor per year: the report or questionnaire you obtained, who reviewed it, exceptions and CUECs noted, and the decision to continue, change or end. The CUEC guide explains the controls a vendor's report expects of you.
Contract terms for Tier 1 and Tier 2: confidentiality, incident notice, sub-processors, data return or deletion.
A questionnaire on file where a vendor has no report. The free vendor security questionnaire is a starting point.
Offboarding proof when a relationship ends: access revoked, data retrieved or deletion confirmed.

When a vendor is a subservice organization

Your cloud host is a vendor under CC9.2 and usually also a subservice organization in your report. Which of your vendors qualify, and whether your report carves them out or includes them, is a separate decision with its own consequences. See carve-out vs inclusive method. Either way, the annual review of that vendor is evidence under CC9.2, as in the table above.

Frequently asked questions

What does SOC 2 require for vendor management?: Criterion CC9.2 reads: "The entity assesses and manages risks associated with vendors and business partners." Linford & Co. and Vanta both quote it that way. The criterion does not prescribe steps. Linford says the points of focus beneath it are examples and not all of them apply to every company. In practice that means a vendor inventory, a way to assess each vendor, and dated records that you did.
Do I need a SOC 2 report from every vendor?: Neither Linford nor Vanta says so. Linford lists reviewing a vendor's latest SOC 1 or SOC 2 report as one typical activity, and Vanta treats the report as a useful input. Which vendors you review, and how, is your risk decision, and your CPA firm judges whether the evidence supports it. What you keep is the review record: who looked at what, when, and what you decided. The generated Vendor Policy asks for an independent assurance report only for Tier 1 vendors.
How often should I review vendors for SOC 2?: Linford's wording is "at least annually", scaled to risk: more often for a riskier vendor. Vanta gives no fixed interval and says compliance with commitments is assessed periodically. The generated Vendor Policy reviews Tier 1 and Tier 2 vendors at least annually and Tier 3 vendors every two years or when their use changes. That default is Policyseed's, not a requirement of the criteria.
Is a vendor security questionnaire enough?: The sources do not say a questionnaire is or is not enough. Linford and Vanta both describe periodic security reviews as the activity, with a SOC report as one input. For a vendor with no report, a completed questionnaire plus contract terms is a common fallback, and the generated Vendor Policy accepts an assurance report or a completed questionnaire for Tier 2. Whether it satisfies your auditor is the CPA firm's call.
Are AI tools vendors under CC9.2?: If a tool receives company or customer data or connects to your accounts, treat it as a vendor: put it in the inventory, tier it, and record the data terms you accepted. The generated Vendor Policy applies the same rule to free, trial and personal-account services and to AI services connected to company accounts. Neither fetched source discusses AI tools, so this is our reading, not theirs.
What is the difference between a vendor and a subservice organization?: A subservice organization is a vendor whose controls are needed, together with yours, to meet the commitments in your report, such as the cloud host. Most vendors are not subservice organizations. The subservice organizations appear in your system description and are carved out or included; every vendor falls under CC9.2. The carve-out guide on this site covers the distinction.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.