Understanding how and when to issue a soc 2 bridge letter (frequently referred to in corporate procurement as a "gap letter") is one of the most practical operational skills in enterprise SaaS sales. Imagine this recurring scenario: your sales team is closing a flagship enterprise customer in November. The prospect's vendor risk management team requests your SOC 2 Type 2 report. You proudly send over your report—only for procurement to respond: "This report ended on September 30. It is now November 15. We cannot sign until you provide assurance covering the interim 45 days."
Because independent Certified Public Accountant (CPA) firms examine historical periods, there is an inevitable temporal gap between the end date of an audit observation window and the date a prospective customer reviews your credentials. You cannot hire an auditor to re-audit your company every Tuesday. This is precisely where a formal SOC 2 bridge letter bridges the divide.
A SOC 2 bridge letter is an official document signed by corporate management that provides interim assurance covering the period between the conclusion of your most recent SOC 2 report and the current date or subsequent audit period. Below, we explain the legal boundaries of bridge letters, when enterprise buyers accept them, and provide free downloadable templates formatted to standard enterprise expectations.
Before reviewing bridge letters, verify your underlying report structure with our SOC 2 Report Example teardown and understand observation periods in our SOC 2 Type 2 Audit guide.
Enterprise procurement teams scrutinize bridge letters because software vendors undergo significant operational changes in short periods of time. A high-growth technology startup might double its engineering team, migrate dozens of microservices across cloud availability zones, or introduce new subservice AI integrations within a 90-day window. The bridge letter provides relying parties with formal, auditable accountability that despite ongoing operational velocity, your foundational security baseline and control parameters remain uncompromised.
Download Free SOC 2 Bridge Letter Template
Pre-formatted enterprise management assertion template with standard bracketed placeholders. Available in fully editable Word (.docx) and print-ready PDF formats.
What a SOC 2 Bridge Letter Can and Cannot Assert
To maintain regulatory compliance and legal credibility, technology leadership must understand the strict boundaries governing bridge letters under American Institute of Certified Public Accountants (AICPA) guidelines:
| What a Bridge Letter CAN Assert | What a Bridge Letter CANNOT Assert |
|---|---|
| Management's representation that internal controls have continued to operate effectively since the audit period ended | It CANNOT claim to be an official attestation report or audit opinion |
| Affirmation that no material changes occurred in technical architecture, security policies, or infrastructure | It CANNOT extend the CPA firm's audit opinion to the current date |
| Disclosure of specific operational or system changes that took place during the interim period | It CANNOT be signed or issued by the independent CPA firm |
| Confirmation that management is unaware of any material data breaches or control failures | It CANNOT substitute for an annual audit if the underlying report is over 12 months old |
Who Signs a Bridge Letter? The Strict Independence Rule
A critical point of confusion among founders is who actually signs the bridge letter. A bridge letter is issued and signed exclusively by management of the service organization.
Under AICPA professional standards (SSAE 18 / AT-C Section 205), independent CPA firms cannot and will not sign a bridge letter. An auditor cannot attest to control effectiveness for a time period they have not formally examined through fieldwork and evidence sampling. Any document claiming to be a "CPA-issued bridge letter" is fraudulent and will be immediately rejected by corporate vendor risk analysts.
Appropriate executive signatories within your organization include:
- Chief Information Security Officer (CISO) or Head of Information Security
- Chief Technology Officer (CTO) or VP of Engineering
- Chief Executive Officer (CEO) or Chief Operating Officer (COO)
- General Counsel or Head of Legal & Compliance
When Enterprise Procurement Accepts a Bridge Letter (The 90-Day Rule)
While bridge letters are a recognized standard in enterprise SaaS vendor risk management, corporate procurement policies impose strict limitations on their validity and acceptance:
1. The Universal 90-Day Ceiling
In enterprise procurement practice, bridge letters are universally accepted for periods up to 3 months (90 days) from the end date of the prior report. For example, if your SOC 2 Type 2 report ended on December 31, a bridge letter will easily satisfy enterprise procurement teams through March 31.
2. The Gray Zone: 90 to 120 Days
Between 90 and 120 days, acceptance depends on the buyer's risk tolerance and the status of your upcoming audit. If your company can provide an official CPA audit confirmation letter (a formal note from your CPA firm confirming that fieldwork for the new period is actively underway), procurement teams will typically grant a grace period.
3. The Hard Stop: Beyond 120 Days
Virtually no Fortune 500 enterprise, regulated financial institution, or healthcare provider will accept a bridge letter covering a gap exceeding 120 days. Beyond 4 months, corporate vendor risk frameworks consider the underlying report stale. Attempting to bridge a 6-month or 1-year gap with a management letter will be rejected as non-compliant.
How to Use the Free Downloadable Template: Step-by-Step Guide
Our free downloadable template is designed to satisfy the strict requirements of enterprise risk analysts. Here is how to customize the template for your organization:
- Place on Formal Corporate Letterhead: Transfer the template text onto your company's official letterhead, including corporate address, legal entity name, and contact information.
- Identify the Specific Relying Party: Address the letter directly to the prospective customer, vendor risk analyst, or procurement officer (e.g., "To: Acme Corp Vendor Risk Assessment Team"). Avoid sending generic "To Whom It May Concern" letters if possible, as addressed letters carry greater legal weight.
- Cite the Underlying Examination Precisely: Accurately name your independent licensed CPA firm, the exact system or cloud platform name, and the specific dates of the prior observation window.
- Define the Exact Bridge Period: Clearly state the start date (the day following your prior audit period end date) and the end date (the current date or scheduled contract execution date).
- Select Disclosure Option A or B: If no significant technical changes occurred, select Option A. If your company completed a planned infrastructure migration, upgraded your identity provider, or refreshed security policies, select Option B and describe the update factually, emphasizing that control effectiveness was maintained.
- Obtain Executive Signature: Have an authorized corporate officer sign and date the document. Distribute the completed bridge letter alongside your full SOC 2 Type 2 report under mutual NDA.
Deconstructing the Bridge Letter: Clause-by-Clause Walkthrough
To ensure full transparency and legal defensibility, our downloadable template is organized into five distinct legal and operational sections. Understanding the purpose of each clause ensures your management team signs with confidence:
Clause 1: Citing the Underlying Independent Attestation
A bridge letter possesses zero legal validity without a solid underlying examination. This clause explicitly identifies the accredited CPA firm that conducted your prior audit, the specific Trust Services Criteria covered (e.g., Security, Availability, Confidentiality), the exact dates of the examined observation window, and the resulting unqualified opinion. This establishes that your control environment was recently scrutinized and validated by an accredited third party.
Clause 2: Defining the Elapsed Bridge Period
Precision in dates is paramount. The bridge period begins the exact day following the close of your prior audit period (e.g., October 1, 2026) and terminates on the current date or an agreed-upon interim milestone (e.g., December 31, 2026). The clause explicitly calculates the elapsed duration in days or months, providing the relying party's compliance team with an unambiguous timeframe.
Clause 3: The Core Management Affirmation
This is the substantive heart of the bridge letter. In this section, corporate management makes three affirmative representations:
- Control Continuity: Management affirms that internal controls, technical safeguards, and operational policies have continued to operate effectively in all material respects.
- Absence of Adverse Changes: Management certifies that no architectural, organizational, or procedural changes occurred that would diminish the achievement of the AICPA criteria.
- Zero Known Incidents: Management confirms that it is unaware of any security breaches, ransomware events, unauthorized data exfiltration, or control failures that would impair customer data confidentiality or system integrity.
Clause 4: Disclosure of Operational Updates (Option A vs. Option B)
No technology company remains entirely static. A common dilemma is what to disclose when routine updates occur:
- Option A (No Material Changes): Select this option if your production infrastructure, security tooling, and key personnel remained fundamentally unchanged during the interim window.
- Option B (Disclosed Operational Updates): If your organization completed a routine infrastructure update—such as upgrading your single sign-on (SSO) provider, migrating to a new AWS region, or onboarding a new HRIS—disclose it transparently. Document that the update was executed under formal change management protocols (CC8.1) and that control effectiveness was maintained. Transparent disclosure enhances credibility with enterprise vendor risk analysts.
Clause 5: Legal Limitations and Auditor Disclaimer
To avoid misrepresentation claims under AICPA and statutory fraud rules, this clause clearly articulates that the bridge letter is a management assertion, not an attestation report, does not extend the CPA firm's opinion, and is distributed strictly under corporate non-disclosure agreements.
Comparative Assurance Instruments: Bridge Letter vs. Other Proofs
When communicating with customer procurement teams, it is important to choose the right security document for the appropriate stage of vendor evaluation:
| Assurance Instrument | Issuing Party | Legal Confidentiality | Primary Use Case |
|---|---|---|---|
| SOC 2 Type 2 Report | Independent Licensed CPA Firm | Restricted-Use (Strict NDA Required) | Formal security due diligence for enterprise contract execution |
| SOC 2 Bridge Letter | Service Organization Management | Restricted-Use (Distributed with Report) | Bridging the temporal gap (up to 90 days) between annual audits |
| SOC 3 Report | Independent Licensed CPA Firm | Public Document (No NDA Required) | Marketing, website trust badges, and high-level customer overviews |
| Readiness Assessment Diagnostic | Internal Team / Diagnostic Tool | Internal Only (Zero External Distribution) | Pre-audit scoping and gap discovery prior to engaging auditors |
Handling Procurement Objections: What to Do When a Buyer Pushes Back
Occasionally, an over-zealous enterprise risk analyst or procurement officer may push back on a bridge letter. Here is how to navigate common procurement challenges:
-
Objection: "Our corporate policy requires an audit report dated within the last 6 months."
Response: Explain that SOC 2 examinations operate on annual cycles to capture seasonal and operational trends. Provide your 12-month Type 2 report alongside your current bridge letter, and offer a written letter from your CPA firm confirming the dates of your upcoming annual examination. -
Objection: "Can your CPA firm co-sign this bridge letter?"
Response: Politely explain that AICPA Professional Standards (SSAE 18 / AT-C 205) strictly prohibit CPA firms from co-signing management gap letters for unexamined periods. Provide a link to official AICPA standards or offer to connect their audit team with your CPA partner to confirm professional guidelines. -
Objection: "We require proof of continuous monitoring between audit periods."
Response: In addition to the bridge letter, share your latest external penetration testing executive summary (completed within the last 12 months) and a real-time link to your live Trust Center demonstrating continuous posture monitoring.
The Annual Compliance Rhythm: How to Never Fall Out of Coverage
Leading SaaS companies avoid temporal gap panics by institutionalizing an annual compliance cadence:
- Observation Period (Months 1–12): Maintain continuous automated evidence collection, enforce change management branch protection, and execute quarterly user access reviews without interruption.
- Audit Fieldwork Kickoff (Month 12 + 1 Day): Immediately deliver sampled evidence workpapers to your independent CPA firm.
- Bridge Letter Issuance (Months 12–14): While the CPA firm conducts testing and drafts the formal report (typically 4 to 8 weeks), issue a bridge letter to all active sales prospects bridging from Month 12 to the present date.
- Final Report Distribution (Month 14): Publish your new unqualified SOC 2 Type 2 report, resetting the 12-month clock and retiring the prior bridge letter.
Vendor Bridge Letters: Managing Your Third-Party Subservice Organizations
Bridge letters are not only documents that you provide to your customers; they are also critical evidence artifacts that you must collect from your third-party subservice vendors. Under AICPA Common Criteria CC9.2 (Vendor Risk Management), your independent CPA auditor will scrutinize how your organization monitors its supply chain security.
When your auditor samples your critical vendors—such as cloud infrastructure providers (Amazon Web Services, Microsoft Azure, Google Cloud), identity directories (Okta, Google Workspace), and database hosting services—they will examine the coverage period of each vendor's SOC 2 Type 2 report. If AWS's report ended in June and your audit takes place in October, your auditor will require you to produce AWS's management bridge letter covering the interim months.
Major enterprise cloud vendors make their bridge letters available self-service through dedicated compliance portals:
- AWS Artifact: Amazon Web Services provides downloadable quarterly bridge letters directly within the AWS Artifact management console.
- Google Cloud Compliance Reports Manager: Google publishes interim management assertion letters for Google Cloud Platform (GCP) and Google Workspace under customer login credentials.
- Microsoft Service Trust Portal: Microsoft publishes bridge letters covering Azure, Office 365, and Dynamics 365 on a continuous quarterly cadence.
If a smaller, critical third-party vendor refuses or fails to provide an updated SOC 2 report or bridge letter, your organization must document compensating vendor controls—such as performing an internal security questionnaire review, verifying data encryption at the application layer, or restricting network access to the vendor's API.
Legal Weight and Governance: Why Bridge Letters Require Diligence
Because a bridge letter does not require CPA auditor sign-off, non-technical executives occasionally make the mistake of treating it as a trivial administrative formality. This is a hazardous operational posture.
In commercial and statutory law, a bridge letter is a formal management representation. If an executive officer signs a bridge letter certifying that "no material security incidents or control breakdowns occurred" when engineering leadership was actively aware of an unresolved data breach, unencrypted database exposure, or systemic failure in change management, the document can serve as evidence of intentional misrepresentation, commercial fraud, or breach of customer contract.
To maintain organizational integrity and legal compliance:
- Execute an Internal Security Verification Check: Before presenting the bridge letter to an executive for signature, the compliance officer or security lead should review security dashboards, Jira incident queues, and change logs to verify that no material incidents occurred during the bridge period.
- Verify Policy and Architectural Stability: Confirm with DevOps and engineering leadership that no major, unmonitored infrastructure overhauls were executed outside of standard change control protocols.
- Retain Signed Copies in Compliance Archives: Maintain a permanent register of all executed bridge letters, noting the date, recipient customer, and the specific underlying SOC 2 report version.
Maintaining Continuous Audit Readiness Between Annual Cycles
A bridge letter is an interim administrative bridge, not a permanent substitute for operational rigor. While your bridge letter satisfies procurement today, your engineering team must maintain continuous evidence collection so that your subsequent annual examination proceeds without test exceptions.
To ensure your control environment remains audit-ready across all 5 Trust Services Criteria:
- Benchmark your technical controls using our free SOC 2 Readiness Assessment.
- Maintain your evidence collection schedule using our interactive SOC 2 Compliance Checklist.
- Review operational expectations in our complete guide to SOC 2 Type 2 Audits.
Frequently Asked Questions: SOC 2 Bridge Letters
Answers to the most critical legal, operational, and commercial questions regarding SOC 2 bridge letters and procurement acceptance.
How long is a SOC 2 report valid?
In technical terms governed by AICPA standards, a SOC 2 report does not have an official statutory expiration date; rather, it reflects control effectiveness over a specific historical period. In commercial practice, however, enterprise procurement teams, corporate risk committees, and vendor management departments recognize a SOC 2 Type 2 report as valid for exactly 12 months following the end date of the auditor's observation period. Once a report passes the 12-month mark, buyers consider it "stale" or expired and require either an updated annual examination or an interim management-signed bridge letter.
How often are SOC 2 reports required?
SOC 2 reports are required on an annual recurring cadence by enterprise customers and vendor risk management frameworks. Because enterprise software providers continuously deploy code, onboard staff, and modify cloud configurations, corporate risk policies mandate annual re-attestation to ensure continuous security assurance. Technology vendors selling into mid-market and enterprise markets must budget for and execute a SOC 2 Type 2 examination every 12 months without lapses between observation windows.
How often should a SOC 2 audit be performed?
A SOC 2 audit should be performed annually. For most technology companies, standard operational cadence involves maintaining a continuous 12-month observation window that aligns with the corporate fiscal year or standard calendar year. Fieldwork is typically initiated immediately following the conclusion of the observation period, with the final CPA attestation report published within 4 to 8 weeks. For the interim gap between the period end date and report issuance, companies issue a bridge letter.
Are SOC 2 Type 2 reports public?
No, SOC 2 Type 2 reports are not public documents. Under AICPA professional standards (SSAE 18 / AT-C Section 205), SOC 2 reports are legally classified as "restricted-use" reports intended solely for the management of the service organization, current customers, prospective customers undergoing active security due diligence, and their independent auditors. Because SOC 2 Type 2 reports contain highly sensitive technical details—including internal system architecture, security controls, and specific auditor test results—they are distributed strictly under a binding Non-Disclosure Agreement (NDA).
Is a SOC 2 report confidential?
Yes, a SOC 2 report is a strictly confidential document. Unlike public SOC 3 reports (which provide a high-level summary of security posture without detailing internal controls or test results), a SOC 2 Type 1 or Type 2 report details proprietary infrastructure configurations, vulnerability management processes, and specific auditor sample populations. Technology organizations routinely gate their SOC 2 reports behind enterprise NDAs or secure customer Trust Centers requiring click-through confidentiality terms.
How to get a SOC 2 type 2 report?
To obtain a SOC 2 Type 2 report, an organization must: (1) Define the system boundary and select applicable Trust Services Criteria; (2) Implement and document required administrative policies and technical controls satisfying AICPA Common Criteria; (3) Operate the control environment cleanly throughout a defined observation period (typically 3 to 12 months) while collecting immutable evidence; (4) Engage an independent, licensed Certified Public Accountant (CPA) firm to conduct audit fieldwork; and (5) Collaborate with auditors during evidence walkthroughs, sample testing, and report drafting until the CPA firm issues its final attestation opinion.