A SOC 2 Bridge Letter is a short statement that explains the gap between a completed SOC 2 audit period and the current date. It gives customers interim assurance that controls remain in place, while typically noting any material changes, incidents, or exceptions since the last report.
What a SOC 2 Bridge Letter Does
A SOC 2 bridge letter is not a new audit opinion, it is a short interim assurance statement that helps customers understand what has changed since the last completed report. It is most useful when procurement, renewals, or vendor reviews need current context before the next SOC 2 period is available.
Because the letter bridges a time gap, it should be read as a limited update rather than a substitute for the underlying report. The value comes from confirming whether the control environment is broadly unchanged, while also surfacing any material events that could affect trust.
How It Fits Into Third-Party Assurance
Bridge letters sit in the middle of vendor assurance workflows, where customers want to know whether a provider’s control posture has remained stable after the audit window closed. They often support security questionnaires, due diligence reviews, and contract renewals that cannot wait for the next SOC 2 cycle.
That role makes the letter a trust document, not a control document. The underlying assurance still comes from the SOC 2 report and the control environment behind it, which is why the SOC 2 Trust Services Criteria (AICPA) remain the authoritative reference for what the report itself is meant to cover.
A bridge letter is also closely tied to report scoping and evidence continuity. Where customers need a deeper explanation of the audit period, carve-outs, exceptions, and bridge letters together, the SOC 2 Guide is the most direct companion resource.
What A Bridge Letter Should Make Clear
Good bridge letters are precise about timing, scope, and any changes since the last report date. They usually state whether there have been material incidents, control exceptions, ownership changes, or major service changes that could alter the customer’s view of risk.
They should also avoid overstating certainty. If the letter says controls remain in place, that statement is only as strong as the provider’s current monitoring, change management, and incident awareness at the time it was written.
For that reason, readers should treat a bridge letter as a snapshot of continuity, not a re-audit. It is most meaningful when the provider can point back to the completed SOC 2 report and explain whether anything materially changed in the interim.
How Buyers Should Read The Gap
The practical question is whether the bridge letter closes the assurance gap enough for the decision at hand. For low-risk renewals, a clean letter may be sufficient; for higher-risk vendors or sensitive data flows, it should trigger follow-up questions about incidents, exceptions, and remediation status.
Buyers should pay close attention to wording that hints at unresolved issues, especially if the letter mentions exceptions without context or avoids saying whether any significant events occurred. In practice, the value of the letter depends on what it reveals, and what it does not.
When used well, a bridge letter supports continuity of trust between audit cycles. When used poorly, it can become a vague reassurance note that masks a control change the customer should have examined more closely.
Risk and Threat Considerations
A bridge letter creates risk when organisations treat it as stronger assurance than it actually is. The main exposure is stale trust, where a customer assumes the control environment is unchanged even though incidents, exceptions, or operational drift may have occurred since the last audit period.
Failure mechanism: The gap between the last completed SOC 2 period and the current date can hide changes in controls, incidents, or service delivery conditions that are material to customer risk, especially if the letter is vague or incomplete.
Impact: Buyers may renew, onboard, or retain a vendor without recognising new security, availability, confidentiality, or privacy exposure that should have been escalated or re-reviewed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
SOC 2 (AICPA) and ISO/IEC 27001:2022 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| SOC 2 (AICPA) | CC6.1 — Logical Access Security Measures | Bridge letters rely on interim continuity of access control assurance between SOC 2 periods. |
| CC7.2 — Change Management | Material changes since the last audit are central to what a bridge letter must disclose. | |
| CC7.4 — Incident Response | Bridge letters often note incidents or exceptions that affect interim trust decisions. | |
| Recommendation — Review ongoing logical access evidence before accepting a bridge letter as current assurance. Track significant environment changes and confirm they are reflected in the bridge letter. Escalate any post-report incidents before relying on the bridge letter for vendor assurance. | ||
| ISO/IEC 27001:2022 | A.5.19 — Information security in supplier relationships | Bridge letters support supplier assurance during the period between formal assessment points. |
| A.5.20 — Addressing information security within supplier agreements | The letter often informs contractual expectations about reporting changes and incidents. | |
| Recommendation — Use supplier-security requirements to decide whether interim assurance is sufficient. Define in supplier agreements when interim assurance updates must be provided. | ||
Practitioner Guidance
What to watch for: Use bridge letters as a prompt for judgement, not as a standalone control. If the letter contains broad assurances but little detail, ask whether the provider has had incidents, significant exceptions, scope changes, or control ownership changes since the report date.
Governance implication: Procurement, security, and vendor-risk teams should define who approves a bridge letter, what questions it must answer, and when it is insufficient on its own. That keeps the letter in its proper place as interim assurance rather than substitute evidence.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 25, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org