Complementary User Entity Controls (CUEC)
Controls your customers must implement for your SOC 2 report's conclusions to hold.
CUECs are documented in a SOC 2 report's description to tell readers which controls customers are expected to run on their side. Example: if you provide an API, the CUEC often says the customer must rotate API keys. If a customer doesn't implement the CUEC, the auditor's opinion on your controls doesn't cover their side of the shared responsibility.