SOC 2 Bridge Letter: What It Is and When You Need One
Key takeaways
A SOC 2 bridge letter covers the gap between your last report and your next.
Management signs the bridge letter, not your auditor.
Bridge letters cover roughly three months; buyers grow skeptical past six.
A bridge letter states whether your controls changed, nothing more.
It reassures customers during an audit gap but never replaces a report.
Your SOC 2 Type II report just expired, and a prospect in the middle of a security review is asking for current proof. Your next audit period has not closed yet, so you have nothing new to hand them. A bridge letter is how you cover that window.
What is a SOC 2 bridge letter?
A SOC 2 bridge letter is a short, signed statement that covers the period between the end date of your most recent SOC 2 Type II report and the start of your next reporting period. It is sometimes called a gap letter or a management assertion letter. It confirms that the controls described in your last report are still in place and that nothing material has changed. It is a stopgap, not a new audit.
When do you need one?
The usual trigger is a customer or prospect asking for coverage during the window your current report no longer reaches. Your last report might cover January through December, that report is now dated, and your next Type II window is still open. Renewals, vendor security reviews, and enterprise procurement checks are the most common moments a bridge letter gets requested.
Who signs the bridge letter?
Management signs it, usually whoever genuinely owns the control environment. At larger companies that is often the CISO or CTO. At smaller companies the CEO signs. Your audit firm does not write or sign a bridge letter, because attesting to a period they have not examined would undermine the attestation itself.
What goes in a SOC 2 bridge letter?
A useful bridge letter is short and specific. It references your most recent SOC 2 report by name and states the exact period that report covered. It confirms the trust services criteria you were assessed against. It states whether any material change has occurred in the control environment since the report period ended. It includes a management responsibility statement and a disclaimer that the letter is not an audit opinion.
How long can a bridge letter cover?
Most auditors and customers accept a bridge letter that covers up to about three months. Coverage of three months or less rarely raises questions. Past three months, and especially past six, buyers start to push back, because a longer gap means more time without independent testing. If your gap is stretching toward half a year, the real answer is to schedule the next audit, not to write a longer letter.
What a bridge letter cannot do
A bridge letter does not extend your SOC 2 report, and it does not provide new assurance. No independent party tests your controls during the bridge period. It is a management statement, so it carries the weight of your word, not an auditor’s. Treat it as a courtesy that keeps a deal moving, not as evidence that stands in for a report.
Frequently asked questions
Is a SOC 2 bridge letter the same as a SOC 2 report?
No. A SOC 2 bridge letter is a management statement covering a short gap, while a SOC 2 report is an independent auditor’s examination of your controls over a defined period.
How long is a SOC 2 bridge letter valid?
Most cover up to about three months. Buyers commonly accept three months or less and grow skeptical past six, so a long gap is a signal to schedule your next audit.
Does my auditor write the bridge letter?
No. Your organization’s management writes and signs it. The audit firm cannot attest to a period it has not examined.
A Compliance Snapshot will surface the gap in two weeks, with a clean roadmap and no commitment beyond the assessment. Leave a comment below or reach out at hello@tailoredcompliancesolutions.com to talk through where you are.
Related services
Compliance Snapshot: tailoredcompliancesolutions.com/compliance-snapshot
Reverse Compliance Runway: tailoredcompliancesolutions.com/reverse-compliance-runway
Recommended reads
AICPA and CIMA, SOC 2 (SOC for Service Organizations) resources
Linford and Company, What are Bridge (Gap) Letters in SOC Reports?
AICPA and CIMA, Trust Services Criteria
