Your customer wants your SOC 2 report.
Good news: You have a SOC 2 report!
Bad news: It’s out of date. At least until your new report is issued next month.
Instead, you give them a SOC 2 bridge letter.
A SOC 2 bridge letter, well, bridges that gap. It’s a short statement signed by your management that says whether your controls have changed, failed, or that you’ve suffered a security incident since the report period ended. Used well, it keeps a sale or a renewal moving. Treated as a substitute for an audited report, it gives the reader false comfort.
The confusion starts when customers (and sometimes vendors) ask for “the letter.” Two different documents go by that name. One comes from your management, and the other comes from your auditor. They do different jobs, and asking for the wrong one slows everyone down.
We hear about these letters from both directions: from companies that have to provide them, and from companies that receive them from vendors. This guide covers each letter, how they differ, and what to do with them.
What Is a SOC 2 Bridge Letter?
A SOC 2 bridge letter (also called a gap letter) is a written statement from a company’s management covering the time between the end of its most recent SOC 2 reporting period and today, or the date the next report is expected.
Who writes a SOC 2 Bridge Letter?
The service organization’s management (the company the SOC 2 report describes), not the auditor. It goes on company letterhead and is usually signed by an executive who knows the control environment and has authority to speak for the company, such as the CEO, CTO, or CISO. A salesperson trying to close a deal is NOT the right signatory.
What does a SOC 2 Bridge Letter Cover?
A bridge letter covers the gap between one SOC 2 report ends, before a new report is issued. A Type 2 report tests whether controls operated effectively over a defined reporting period, often 12 months, and it speaks only to that period. Every day after the period ends, the report describes a slightly older version of your company. The bridge letter covers the stretch from the end of that period to today, or to the date the next report is expected.
What does a SOC 2 Bridge Letter Say?
Bridge letters (usually) state that there have been no material changes to the system or controls since the period ended. Unless there have been changes, in which case those changes are described. The letter also says whether the next audit is scheduled or underway, and it discloses any known exceptions or changes.
Do auditors attest or certify SOC 2 bridge letters?
No CPA firms attest to a bridge letter, and no AICPA (American Institute of Certified Public Accountants) standard covers it. As Linford & Co., a CPA firm that performs SOC examinations, notes, “the AICPA doesn’t actually cover bridge letter requirements in the SOC guidance.” A bridge letter’s value comes from the existing SOC 2 report it points back to. The executive’s signature makes management accountable for what the letter says, which is a good reason to have someone who knows what changed review it before it goes out.
How long do bridge letters usually cover?
Customers typically accept a gap of about three months. A bridge letter that reaches beyond three to six months rarely satisfies a procurement team, which will ask for the full report.
A Sample SOC 2 Bridge Letter
Below is an illustrative example for a fictional company, ACME Software. Use it to learn the parts. Beware, it is not meant to be a template! Every letter must contain its own facts.
[ACME Software letterhead]
January 15, 2027
To: Customers and prospective customers of ACME Software
(1) Fake CPA LLC issued a SOC 2 Type 2 report on ACME Software’s ACME platform, covering the Security criteria for the period October 1, 2025 through September 30, 2026. The report is dated November 20, 2026.
(2) This letter covers the period after the report period ended, from October 1, 2025 through the date of this letter, January 15, 2027.
(3) Management is not aware of any changes to our system or control environment during this period that would materially affect the conclusions in that report, except as noted below.
(4) In December 2025, we moved customer support ticketing to a new provider. Access to the new tool requires single sign-on with multi-factor authentication, consistent with the access controls described in the report. No security incidents requiring customer notification occurred during this period.
(5) Our controls were designed with the expectation that customers implement the complementary user entity controls described in the report. Customers remain responsible for those controls.
(6) We have engaged Fake CPA LLC for our next SOC 2 Type 2 examination, covering October 1, 2025 through September 30, 2026. That period is in progress, and we expect the report to be available in November 2026.
(7) This letter is a representation by management. Neither Fake CPA LLC nor any other independent auditor has examined it, and it does not replace the SOC 2 report. Please read the full report.
[Signature]
[Name], Chief Executive Officer
Here’s what each numbered part does:
- Identifies the report. It names the company, the system or product in scope, the report type, the criteria (Security is the only required category), the period, the CPA firm, and the report date. The recipient should be able to match every detail to the report in hand.
- States the bridge period. It gives a start date and an end date. Without them, the reader has to guess which months the letter speaks to, and whether it covers the date their own review needs.
- Makes the core representation. Management says it’s “not aware of any changes” that would materially affect the report’s conclusions, “except as noted below.” A letter with nothing listed below is only honest if nothing happened.
- Discloses subsequent changes. It lists new systems, new subservice organizations (the vendors your controls depend on, such as a cloud provider), an acquisition, major personnel changes, security incidents, or fixes to exceptions from the prior report. A disclosed change gives the reader context. A change you left out can show up in the next report’s system description, and then the whole letter looks less trustworthy.
- Restates user responsibilities. Complementary user entity controls are the controls each customer is expected to run on their side, such as managing their own users’ access. A bridge letter doesn’t move that responsibility.
- Gives the status of the next audit. It says the next examination is underway (or scheduled) and when the full report is expected, so the reader knows when to ask for it.
- Disclaims assurance. It says the auditor wasn’t involved and the letter doesn’t replace the report.
For a real-world example of the format, look at Atlassian’s bridge letter from January 2025. Its gap is about the same as our sample’s (roughly three and a half months), and it has most of the same parts.
Atlassian’s Chief Trust Officer signed it. It references a SOC 2 Type 2 report for the period ending September 30, 2024, and says the letter “is not intended to be a substitute for the SOC 2 report.” Instead of naming a start and end date, it speaks “as of” a single date (January 16, 2025), which leaves the reader to infer that coverage runs from the end of the report period to that date.
Use it as an example of structure and of who takes responsibility. It’s a historical document, so it says nothing about Atlassian’s controls today.
What Is an Auditor Letter?
“Auditor letter” usually means one of two things, neither of which should be confused with a bridge letter.
The “Audit in Progress” Letter
This letter goes by a few names, including engagement letter and status letter. The CPA firm confirms it has been engaged for a SOC 2 audit and gives the report type, the period, and the expected report date. Secureframe describes it as a signed statement from your auditor confirming you’re undergoing SOC 2, with an expected completion date.
Companies use it most often before their first report, when there’s nothing to bridge from. It can also help in the short window after an audit is finished but before the report is issued. Either way, it gives no opinion and no assurance about the controls. It only confirms that the audit exists and when the results are due.
The Auditor’s Opinion
This is the Independent Service Auditor’s Report, the first section of the SOC 2 report itself (usually labeled Section 1). People sometimes call it “the auditor letter” because it reads like a letter from the CPA firm. It’s the part of the report that carries real assurance: the auditor’s conclusion, based on its testing, on whether the controls were designed and operated as described.
Our guide on how to read a SOC 2 report walks through the opinion, along with the system description and any exceptions. A bridge letter only makes sense read alongside that report.
How Do the Two Letters Differ?
Here’s how the bridge letter and the two kinds of auditor letter compare.
| Bridge letter | “Audit in progress” letter | Auditor’s opinion | |
| Who writes it | Your management | Your CPA firm | Your CPA firm |
| Letterhead | Your company’s | The CPA firm’s | Part of the SOC 2 report |
| When it’s used | Between reports | Before a first report, or after an audit ends and before the report is issued | In every SOC 2 report |
| What it covers | The end of the last report period to today, or to the next report date | The audit’s type, period, and expected report date | The report period only |
| Assurance | None (a management representation) | None (it confirms the engagement only) | Yes (based on the auditor’s testing) |
How Should You Handle a Bridge Letter?
Three pieces of advice we give clients who write or request bridge letters:
1. Don’t ask your CPA firm to sign it. The auditor doesn’t prepare or sign a bridge letter, and its opinion doesn’t extend to the bridge period. We tell clients not to ask. Your auditor hasn’t tested anything since the report period ended, and auditors don’t prepare, sign, or validate bridge letters. Signing one would mean attesting to controls outside a formal engagement, which attestation standards don’t permit. If a customer insists on an “auditor-signed bridge letter”, offer the auditor’s “audit in progress” letter instead. It’s usually the closest thing available.
2. Write it carefully. A bridge letter is a representation to your customers, so an inaccurate “no material changes” claim creates contractual and liability risk. Disclose significant changes, such as a new cloud provider, an acquisition, or a security incident. If nobody on your team tracks control changes closely enough to sign with confidence, ongoing SOC 2 program support can keep that record current between audits, so the letter takes an afternoon instead of a scramble.
3. Line up your report periods. Customers who need continuous coverage want report periods to run back to back, so the gap stays short. Schedule (and budget for) the next audit before the current one ends. Mapping your audit calendar against your biggest customers’ review dates is part of how we run SOC 2 programs for clients.
What Should a Recipient Verify?
On the receiving end, treat a bridge letter as one input to your vendor risk management program. It’s management’s word, with no independent testing behind it. Here’s what we check:
- Does it match the report? Look for the same legal entity, the same services in scope, the same period, and the same CPA firm. A bridge letter only speaks to changes since the report it names. If it names a different product, it says nothing about the service you use. If it names an older report, it measures changes against controls that a newer report has since replaced, and it skips whatever that newer report found.
- Are the bridge dates stated? You want a start date (the day after the report period ended) and an end date close to your request. If the letter speaks “as of” a single date, that date is the end of its coverage. A letter dated months before you asked for it has its own gap.
- Who signed it? Look for an officer who would know about changes to the control environment and has authority to speak for the company.
- Does it disclose changes? Watch for new systems, new subservice organizations such as a cloud provider, an acquisition, leadership changes, or security incidents. If a new subservice organization handles your data, ask for its SOC 2 report too. If you know the vendor went through a merger or a platform migration and the letter says nothing, ask.
- What happened to the exceptions? Exceptions are cases where the auditor found a control didn’t work as described. If the report listed any, ask whether the vendor fixed them.
- Are your own controls in place? The complementary user entity controls in the report still apply to you, and a vendor’s letter does nothing for controls you were supposed to run.
- Is the next audit underway? The letter should say so and give an expected report date. Put a reminder on your calendar to request the report.
A bridge letter covers only what management knows and chooses to say. Your contract can require more. It should include terms that obligate the vendor to share new reports when issued, notify you of security incidents, and tell you about material changes to the service. If those terms are missing, add them at renewal.
If a vendor can’t give you either a current report or a bridge letter, record that in your vendor risk assessment and decide whether the risk is one you can accept.
How Does a Bridge Letter Bridge the Gap?
Back to January and that follow-up from the customer’s vendor risk team. If your letter looks like ACME Software’s (report identified, bridge dates stated, the new support tool disclosed, the next audit underway, and the CEO’s signature at the bottom), you can answer the security questionnaire the same day.
The vendor risk team checks the letter against the report, notes the new support tool, and sets a reminder to request the November report. The review keeps moving on management’s signed word until the new audited report arrives.
Write your bridge letters as if a customer will hold you to every line. Read the ones you receive against the report before you file them.
If you’d like help managing SOC 2 all year, Fractional CISO’s SOC 2 compliance services support you from readiness through each annual audit, including the stretch between reports.
Want to get great cybersecurity content delivered to your inbox? Click here to sign up for our monthly newsletter, Tales from the Click.
