SOC 2 bridge letter
A short attestation from your auditor confirming no material changes to controls between the end of your last SOC 2 period and today.
A SOC 2 bridge letter (also called a gap letter) is a document from your audit firm covering the period between the end of your latest SOC 2 report and the current date. It confirms that no material changes to your in-scope controls have occurred in that gap. Enterprise buyers accept bridge letters so a deal can close while you complete the next observation window.
Related terms
- Trust Services Criteria (TSC) — The AICPA framework of five criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy) that a SOC 2 report evaluates against.
- Complementary User Entity Controls (CUEC) — Controls your customers must implement for your SOC 2 report's conclusions to hold.