A SaaS provider's SOC 2 report states that it uses the carve-out method for the colocation company that operates its data centers, and it lists several complementary user entity controls. What does this mean for the customer relying on the report?
Select an answer to reveal the explanation.
Short Explanation
A carve-out is like a home inspection that skips the shared garage: the report says nothing about it, so you need to check it some other way. And the complementary user entity controls are your homework, the things the provider assumes you're doing. Miss either piece and your assurance has a hole in it.
Full Explanation
When a service organization uses a subservice organization, the SOC report can present it using the inclusive method, where the subservice organization's relevant controls are described and tested within the report, or the carve-out method, where those controls are excluded and only the service organization's monitoring of the subservice organization is addressed. With a carve-out of the data center operator, the customer has no assurance from this report over physical and environmental controls at the colocation facility and should obtain the colocation company's own report or other evidence. Complementary user entity controls are controls the service organization assumes its customers have in place, such as managing their own user access or reviewing reports; if the customer does not implement them, the control objectives may not be met. Claiming the colocation controls were tested describes the inclusive method, not a carve-out. Treating user entity controls as provider-performed reverses their meaning. Calling the report qualified misreads the method; a carve-out is a scope presentation choice, not a modified opinion. Exam caveat: complementary subservice organization controls may also be listed for the carved-out party. Operational check: map each listed user entity control to an owned customer control and obtain the subservice organization's current report.