Manufacturers, producers and distributors are asked for SOC 2 reports that were designed for service organisations, and the result is often a report that says a lot about IT systems and very little about how products are actually made, moved and protected. The AICPA built SOC for Supply Chain for that gap: an attestation examination of a production, manufacturing or distribution system and the controls over it. This guide explains what the examination covers, how it differs from SOC 2, what the ten description criteria ask for, where identity and machine credentials fit, and how buyers should read the report. It is for supply chain, quality, security and compliance leads at producers, and for third-party risk teams receiving these reports.
Key takeaways
- It reports on a product system, not a service. SOC for Supply Chain covers the system an entity uses to produce, manufacture or distribute goods, and the effectiveness of controls over that system, as the AICPA describes it.
- Two sets of criteria apply. The 2020 description criteria (DC section 300) govern the system description; the 2017 Trust Services Criteria (TSP section 100) are used to evaluate the controls.
- The description is product-centric. It must cover the types of goods, principal product performance specifications and commitments, system incidents, risks to principal system objectives, and complementary supplier and customer controls.
- Identity controls still carry much of the weight. Logical access to manufacturing execution, warehouse, logistics and supplier portals, including service accounts and API credentials on integrations, sits inside the security criteria.
- Buyers must read the carve-outs. Complementary supplier and customer controls tell you what the report assumes someone else is doing; those assumptions become your due diligence list.
What it is and who it applies to
The AICPA introduced the SOC for Supply Chain framework on 12 March 2020 as part of its System and Organization Controls family alongside SOC 1, SOC 2, SOC 3 and SOC for Cybersecurity. The framework has three parts: description criteria for preparing and evaluating the description of a manufacturer's, producer's or distributor's system; the 2017 Trust Services Criteria for evaluating controls; and an AICPA guide for practitioners, published as SOC for Supply Chain in June 2020, developed by a joint working group of the AICPA Assurance Services Executive Committee and the Auditing Standards Board. The AICPA's current downloadable description criteria and illustrative report are dated 1 October 2023.
It is voluntary. No regulation requires it; customers, business partners and contracts create the demand. It suits organisations whose customers care about product delivery, availability and integrity rather than hosted data processing:
- Manufacturers and contract manufacturers: customers want assurance on how production is controlled and how product specifications are met.
- Producers: including those whose output feeds regulated customers who must show supplier oversight.
- Distribution and logistics companies: warehousing, fulfilment and transport where availability and correct handling are the commitment.
An organisation that provides a hosted service, such as a SaaS platform, still belongs in SOC 2. See the SOC 2 Guide.
How it differs from SOC 2
| Aspect | SOC 2 | SOC for Supply Chain |
|---|---|---|
| Subject matter | A service organisation's system relevant to the trust services categories | A system used to produce, manufacture or distribute goods |
| Description criteria | DC section 200 (nine criteria, per SANS) | DC section 300, issued March 2020 (ten criteria) |
| Control criteria | 2017 Trust Services Criteria | 2017 Trust Services Criteria |
| Commitments described | Service commitments and system requirements | Principal product performance specifications, commitments and requirements |
| Third parties in scope | Subservice organisations, complementary user entity controls | Complementary supplier controls and complementary customer controls |
| Typical users | Customers of the service and their auditors | Customers and business partners of the producer or distributor |
The AICPA guide includes an appendix comparing SOC for Supply Chain, SOC 2 and SOC for Cybersecurity. The comparison above is drawn from the published criteria and secondary summaries; confirm detail against the guide.
Structure and key requirements
The practitioner reports on whether management's description of the system meets the description criteria, and whether the controls stated in the description were effective, based on the applicable trust services criteria. Management signs an assertion covering both. The illustrative material in the AICPA guide shows a report covering a period ("throughout the period"), and the guide also covers a design-only examination and readiness assessments for organisations not yet ready to be examined.
The ten description criteria
SANS summarises DC section 300 as ten criteria. In practice the description must address:
| DC | What the description covers | Practical content |
|---|---|---|
| DC1 | Types of goods produced, manufactured or distributed | Product lines in scope, sites and channels |
| DC2 | Principal product performance specifications, commitments and requirements | Quality, delivery, availability and handling commitments made to customers |
| DC3 | System incidents | Incidents that significantly affected principal objectives in the period |
| DC4 | Risks that could significantly affect achieving principal system objectives | Supplier failure, counterfeit components, production disruption, cyber attack on plant systems |
| DC5 | Relevant information about the production, manufacturing or distribution system | Infrastructure, software, people, procedures and data |
| DC6 | Applicable trust services criteria and related controls | The controls management relies on, mapped to the criteria |
| DC7 | Complementary customer controls | What customers must do for the controls to work |
| DC8 | Complementary supplier controls | What suppliers are assumed to do |
| DC9 | Trust services criteria not relevant to the system, and why | Justified exclusions |
| DC10 | Significant changes to the system during the period | Applies where the report covers a period |
Supplement A of the AICPA guide gives implementation guidance for each criterion. The AICPA notes that disclosures are made only to the extent that they relate to the trust services categories addressed by the description, so choosing categories sets the depth of the whole report.
Choosing trust services categories
- Security: always relevant; it carries the common criteria, including logical access, change management and monitoring.
- Availability: the natural choice for distributors and logistics firms whose commitment is delivery on time.
- Processing integrity: for producers whose commitment is correct, complete and accurate output against specification.
- Confidentiality: where customer designs, formulas or order data are shared with the producer.
- Privacy: where consumer personal data passes through fulfilment or direct-to-consumer channels.
Identity and NHI requirements
The trust services criteria do not name identity products, but the security common criteria on logical and physical access (the CC6 series) are where an examiner tests who and what can reach production, warehouse and logistics systems. In a supply chain system, many of those "who" are not people.
- Plant and warehouse systems: manufacturing execution systems, warehouse management, label printing and ERP modules often run under shared or generic accounts. Each should have a named owner and a documented reason. See the Service Account Security Guide.
- Integrations with suppliers and customers: EDI connections, API keys for carrier and marketplace integrations and supplier portal credentials are machine identities. Inventory them, scope them to the minimum transactions and rotate them on a defined schedule. See the API Key Management Guide.
- OT remote access: vendor maintenance accounts on production equipment should be time-bound and monitored rather than permanently enabled. See the OT Remote Access Guide.
- Automation and AI agents: planning bots and AI agents that place orders or change schedules act with real authority over the product system. Give each its own identity, a least-privilege role and logs that tie its actions to an approver.
- Complementary supplier controls: if a supplier holds credentials into your system, the description should say what you assume they do with them, such as named accounts and prompt removal of leavers.
Our recommendation at NHI Mgmt Group: treat the machine credential inventory as part of DC5 system information and make sure each non-human account appears in the access review evidence the examiner samples.
Implementation steps
- Confirm the fit. Ask key customers what assurance they want. If they need product system assurance, SOC for Supply Chain fits; if they ask about a hosted service, SOC 2 fits better.
- Define the system boundary. Choose product lines, sites, distribution channels and the systems that support them. A tight first scope, one site or one product line, is easier to evidence.
- Write principal system objectives. Turn customer commitments into objectives (for example, orders shipped within the committed window, products meeting specification) that the controls must support.
- Select trust services categories. Security plus the one or two categories that match your commitments.
- Map suppliers and customers. Identify which controls you rely on suppliers and customers to perform. These become complementary supplier and customer controls in the description.
- Run a readiness assessment. Gap-assess controls against the criteria, including identity and access controls for plant and logistics systems.
- Remediate and collect evidence. Close gaps, then operate controls for a full period before the examination starts if you want a period report.
- Engage a CPA firm. Only licensed CPA firms can perform the attestation examination. Agree scope, period and categories in the engagement letter. See SOC 2 Auditor Selection for questions that carry over.
- Draft the description and assertion. Write the system description against DC section 300 and the management assertion; the practitioner evaluates both.
- Plan the cycle. Most organisations repeat the examination on a regular cycle agreed with customers, which keeps the report current.
Evidence and assessment
The practitioner tests controls in the description. The table lists typical evidence areas; your auditor will set the exact samples.
| Control area | Typical evidence | Identity angle |
|---|---|---|
| Logical access | Joiner, mover and leaver tickets; quarterly access reviews for ERP, MES and WMS | Service and integration accounts included in reviews with named owners |
| Supplier management | Supplier risk assessments, contracts, monitoring of complementary supplier controls | Supplier accounts and credentials into your systems listed and reviewed |
| Change management | Approved changes to production recipes, PLC logic and system configuration | Separation between those who change and those who approve |
| Availability and resilience | Capacity planning, backup tests, business continuity exercises for sites | Break-glass accounts tested and logged |
| Incident management | Incident log, root cause analysis, customer notification records | Credential compromise handled through revocation and rotation |
| Monitoring | Alert review records, logs from plant and logistics systems | Machine account activity monitored for unusual use |
Reading a report as a buyer
- Scope: check that the products, sites and channels you buy are inside the boundary.
- Period and type: check whether the report covers a period or design only, and how recent the period end is.
- Categories: check which trust services categories were examined and which criteria were excluded under DC9, and whether the reasons hold for your use.
- Opinion and exceptions: read the practitioner's opinion and any exceptions in the test results.
- Complementary controls: list the complementary customer controls you must operate, and ask how the producer oversees the complementary supplier controls it relies on.
- Incidents and changes: DC3 and DC10 disclosures tell you what happened during the period.
The reading approach mirrors SOC 2. See the How to Read a SOC 2 Report Guide.
Mapping to other frameworks
| SOC for Supply Chain area | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Supplier identification and criticality | GV.SC-04 | SR-3 |
| Supplier requirements in contracts | GV.SC-05 | SR-5, SA-9 |
| Ongoing supplier risk monitoring (complementary supplier controls) | GV.SC-07 | SR-6 |
| System inventory (DC5) | ID.AM-02 | CM-8 |
| Logical access, including machine accounts | PR.AA-05 | AC-2, IA-5 |
| Component authenticity and counterfeit risk (DC4) | GV.SC-07 | SR-11 |
For a broader view of supplier assurance options, see the Third-Party Attestation Comparison Map.
Common pitfalls
- Choosing SOC 2 by habit: a SOC 2 report for a manufacturer often describes the corporate IT estate and leaves out the plant, which is what customers actually depend on.
- Vague principal objectives: objectives such as "high quality" cannot be tested. Tie them to measurable commitments.
- Unlisted complementary supplier controls: relying on a supplier's controls without saying so leaves a hidden gap that buyers will find later.
- Machine accounts outside access reviews: generic plant accounts, EDI credentials and integration keys left out of reviews are a frequent source of exceptions. Include them from the start.
- Scope too wide too early: trying to cover every site in year one stretches evidence collection. Start with one site or line and extend.
- Treating the report as the end: buyers who file the report without acting on complementary customer controls lose much of its value.
Practitioner checklist
- Confirm with key customers that a product system report, not a service report, meets their need.
- Define the boundary: products, sites, channels and supporting systems.
- Write measurable principal system objectives from customer commitments.
- Select Security plus the trust services categories that match those commitments, and justify any excluded criteria.
- List complementary supplier and customer controls and how you monitor the supplier ones.
- Inventory human and machine accounts on ERP, MES, WMS, EDI and supplier portals, with owners.
- Run a readiness assessment, remediate, then operate controls for the full period.
- Engage a CPA firm and agree scope, period and categories in writing.
- As a buyer, check scope, period, categories, exceptions and complementary controls before relying on a report.
Standards and references
- AICPA & CIMA: Description criteria for your SOC for Supply Chain engagement
- AICPA & CIMA: Illustrative SOC for Supply Chain report
- AICPA & CIMA: 2017 Trust Services Criteria (With Revised Points of Focus, 2022)
- AICPA (Wiley): SOC for Supply Chain guide
- Accounting Today: AICPA introduces SOC for Supply Chain reporting framework
- SANS Institute: SOC for Supply Chain
Related NHI Mgmt Group resources: SOC 2 Guide · How to Read a SOC 2 Report Guide · Third-Party Attestation Comparison Map · Service Account Security Guide