A Bridge Letter is a short statement from a service provider covering the period between the end of a third-party attestation report and a later date. In practice, a customer uses it to understand whether significant control changes or incidents occurred after the audit period. Security teams should verify the dates, scope, and management assertions before relying on it.
What a Bridge Letter looks like in practice
A practical bridge letter is usually a short, dated customer-facing statement from the service provider that closes the gap between the end of a SOC 2 or similar attestation period and the date the customer is reviewing the service. It should tell the reader whether anything material changed after the report period, especially around controls, incidents, exceptions, or scope.
In practice, the letter is not meant to replace the underlying report. It works as a gap-filler for procurement, vendor risk, and security review teams that need current assurance before renewing access, signing a contract, or allowing a critical integration to continue.
What security teams should look for in the letter
The useful parts are the dates, the control scope, and the management assertions. A credible Bridge Letter should clearly anchor the period it covers, state whether there were significant control changes, and disclose whether any incidents or exceptions affected the service after the audit period ended.
That makes the letter a control evidence artifact, not a marketing note. If it is vague, undated, or too general, it does not tell the customer much about whether the assurance picture has changed since the report was issued.
For teams reviewing a SOC 2 package, NHIMG’s SOC 2 Guide explains how bridge letters fit alongside Type 1 and Type 2 reports, exceptions, and complementary controls. It is most useful when you need to interpret a bridge letter as part of a broader assurance review rather than as a standalone document.
How to use it without over-trusting it
A Bridge Letter should be treated as supplemental assurance. The right question is not only whether the provider issued one, but whether its claims line up with the report period, known changes in the service, and any incidents you have already seen through security notifications or customer support channels.
Where the letter indicates no material change, teams can use it to bridge the time until the next attestation. Where it reveals changes, the customer may need to reassess contractual risk, request updated evidence, or recheck whether compensating controls still hold.
Bridge letters are strongest when they are specific and bounded. They are weakest when they are used as a substitute for current audit evidence, because they usually depend on management assertion rather than a fresh independent examination.
Risk and Threat Considerations
Bridge letters matter because the risk sits in the gap between formal audit coverage and real-world service change. A provider can remain “in compliance” with the last report while still having introduced control drift, unresolved incidents, or scope changes that alter the customer’s trust decision.
Failure mechanism: The customer assumes the bridge period is quiet when, in fact, material changes occurred after the audit window. That can hide new access paths, weakened controls, or unresolved incidents that should affect vendor approval or renewal decisions.
Impact: Security and procurement teams may rely on outdated assurance, keep a risky integration in place, or miss a change that should trigger deeper review, compensating controls, or escalation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
SOC 2 (AICPA) provides the primary governance reference for this topic.
| Framework | Control / Reference | Relevance |
|---|---|---|
| SOC 2 (AICPA) | CC6.1 — Logical Access Security Software, Infrastructure, and Data | Bridge letters are used to bridge SOC 2 report periods and assess control change. |
| Recommendation — Verify post-report access and control changes before extending assurance reliance. | ||
Practitioner Guidance
What to verify: Check that the bridge period starts the day after the report ends and runs through the date you are making the decision. Confirm that the letter names the exact service or environment covered, not just the vendor brand.
Decision rule: If the letter mentions incidents, control changes, or exceptions, treat it as a prompt to request supporting evidence before you renew, onboard, or expand access. If it is silent on those points, do not assume that silence means stability without checking for independent signals.
Practitioner takeaway: A Bridge Letter is most valuable when it narrows uncertainty, not when it is used to paper over it, so the real discipline is verifying that the assurance period, the service scope, and the management statement all line up.