SOC 2 Bridge LetterWhat It Is, When You Need One, and a Template Your Customers Will Accept

What Is a SOC 2 Bridge Letter?

A SOC 2 bridge letter is a dated, signed document in which the management of a service organization states that, since the end of the review period covered by its most recent SOC 2 report, there have been no material changes to the system description or the controls the report examined, or discloses what changed, and that the controls have continued to operate. The term "gap letter" describes the same document. It exists because SOC 2 Type 2 reports cover a defined review period in the past, typically six or twelve months, while customers need assurance about today.

The mechanics are simple. Suppose your SOC 2 Type 2 report covers January 1 through December 31. The auditor completes fieldwork in January and issues the report in February. A customer performing annual vendor due diligence in April now holds a report whose coverage ended four months ago. They ask a fair question: what has happened since? The bridge letter is your answer. It bridges the end of the report period to the date of the letter, which is why the period it covers is often called the gap period or the stub period.

Two things distinguish a bridge letter from the report it extends. First, authorship: the report is issued by an independent CPA firm under AICPA attestation standards, while the bridge letter is issued by the service organization's own management. Second, assurance: the auditor tested controls and expressed an opinion in the report, while the bridge letter contains management's representation only, with no testing behind it other than what management chooses to describe. That difference is not a weakness to hide. It is the reason the letter is short, the reason customers limit how long a gap they will accept, and the reason the letter should point back to a real report instead of trying to stand on its own.

The SOC 2 Report Cycle and Where the Bridge Letter Fits

Every SOC 2 Type 2 engagement has three dates that matter to a bridge letter: the first day of the review period, the last day of the review period, and the report issuance date. The review period is the window during which the auditor tests whether controls operated effectively. Fieldwork, evidence review, and report drafting happen after the period closes, so the report is usually issued several weeks to a few months after the last day it covers. From the customer's point of view, coverage ends on the period end date, not on the issuance date, and not on the day they download the report from your trust portal.

Organizations that examine annually therefore have a predictable rhythm. For part of the year the current report is fresh. As the months pass, the gap between the period end and today grows, and customers begin asking for a bridge letter. Once the next examination's review period closes and its report is issued, the cycle resets. Organizations that keep a continuous, back-to-back review period, where the next period starts the day after the previous one ended, keep the gap as short as possible and rarely need a letter that covers more than the fieldwork and issuance lag. Organizations that let periods lapse, skip a year, or change auditors mid-stream generate longer gaps and more letter requests. Our SOC 1 vs SOC 2 guide explains the report types in detail, and our SOC 2 Type II page covers how a review period is chosen.

Five Situations That Call for a SOC 2 Bridge Letter

Bridge letters are reactive documents. Most are written because someone asked. Knowing the situations that generate the request lets you prepare the letter and, more importantly, the evidence behind it before the request lands in a deal-blocking email.

What a SOC 2 Bridge Letter Must Contain

There is no single mandated format. There is, however, a consistent set of elements that vendor risk teams and user auditors look for, and a letter missing any of them is likely to be returned with questions. Write the letter in this order and each reviewer will find what they need without a follow-up call.

SOC 2 Bridge Letter Template

The template below contains every element from the list above in the order reviewers expect. Replace the bracketed placeholders, delete the alternative sentences you do not need, and put the result on letterhead. Have counsel review it the first time you use it; after that, the same structure can be reused each cycle with updated dates and facts. Keep the letter to one page. Length signals nothing, and a long letter invites more questions than it answers.

Two drafting notes. First, the phrase "to the best of its knowledge and belief" is standard and appropriate, but it is not a shield: if management knew of an incident and left it out, the qualifier does not help. Second, resist the temptation to add descriptions of controls that were not in the original report. A bridge letter cannot expand scope. If a customer needs coverage of a control you did not examine, that is a scoping conversation for the next audit, and a good SOC 2 compliance checklist will show where the scope should grow.

How Long Can a Bridge Letter Cover?

No standard sets a maximum gap. Acceptance is decided by the reader: the customer's vendor risk policy, or the professional judgment of the user auditor relying on your report. In practice the expectations are consistent enough to plan around. A gap of up to three months is routinely accepted. A gap of three to six months is accepted by some organizations, often with additional questions or a request for interim evidence. Beyond six months, most reviewers will decline the letter and ask for a new report, and some vendor risk policies flag any vendor whose most recent report period ended more than a year ago regardless of what letters were provided.

The practical rule that follows: schedule examinations so that the review periods run back to back, and start fieldwork planning before the current period closes. A service organization on a continuous annual cycle almost never needs a letter that covers more than the two or three months of fieldwork and issuance lag, and its letters are accepted without argument. Organizations we help with ongoing SOC 2 compliance plan the next review period as part of closing the current one for exactly this reason.

Who Writes, Signs, and Reviews a Bridge Letter

The bridge letter belongs to management. It is typically drafted by the compliance or security lead who owns the SOC 2 program, reviewed by counsel the first time and whenever material changes must be described, and signed by an officer: the CEO, CFO, COO, or CISO, depending on who is accountable for the control environment in your organization. The signer should be someone who can be held to the representation, which is why a sales engineer or an account manager should never sign one, however urgent the deal.

The service auditor's role is deliberately limited. The AICPA's SOC 2 guidance treats the bridge letter as a communication from the service organization to its user entities. The auditor does not perform procedures on the gap period, does not review the letter as part of the engagement, and does not extend the report's opinion to it. Some CPA firms will share a template or comment informally on wording, but the letter still goes out under management's signature and management's responsibility. If a customer asks whether your auditor "approved" the bridge letter, the correct answer is no, and the letter itself should already say so.

On the receiving side, the reader is usually a vendor risk analyst applying a third-party risk policy, or a user auditor deciding how much reliance to place on your report for a client's financial statement or SOC examination. Both are trained to look for the elements listed above and to reject letters that are vague about dates, silent on incidents, or missing the auditor disclaimer. Writing the letter with those readers in mind is the whole craft.

How to Evaluate a Vendor's Bridge Letter

Most of our clients are on both sides of this document. They issue bridge letters to their customers, and they receive them from their own vendors: cloud hosts, payroll processors, managed service providers, and software platforms that touch regulated data. A bridge letter from a vendor deserves the same scrutiny your customers apply to yours. Use this checklist when one arrives as part of your IT vendor management review.

When a vendor's letter is weak, the follow-up is a short list of targeted questions, not a rejection of the vendor. Ask for the interim evidence behind the representations, and record the answers with the letter in your vendor file. For vendors whose service includes AI features or model access, our AI vendor security questionnaire covers the questions a standard SOC 2 report usually leaves open.

SOC 1 Bridge Letters and SOC 2 Bridge Letters

The bridge letter concept applies to every SOC report type, and the structure is the same. What differs is who relies on it and how strictly. A SOC 1 report covers controls relevant to a user entity's internal control over financial reporting, so a SOC 1 bridge letter is read primarily by the user entity's financial statement auditor, who needs control coverage through the client's fiscal year-end. That reader tends to be the strictest about gap length and about the incident disclosure, because a control failure at a payroll or transaction processor can change an audit conclusion. A SOC 2 bridge letter is read primarily by security, procurement, and vendor risk teams evaluating the vendor's protection of data, and by user auditors in the SOC 2 context. Both letters should follow the same eight-element structure, and a service organization that issues both reports typically issues both letters on the same cycle.

Two edge cases come up often. A vendor with only a SOC 1 report cannot use a SOC 1 bridge letter to answer a SOC 2 request; the reports examine different criteria. And a vendor whose SOC 2 covers only the Security category cannot bridge a customer's questions about Availability or Confidentiality, because the report never addressed them. In both cases the honest response is a scoping conversation, which is usually where our SOC 2 consulting engagements begin.

Six Bridge Letter Mistakes That Get Vendors Flagged

How Petronella Technology Group Supports the Bridge Letter Process

Petronella Technology Group does not issue SOC 2 reports; only a licensed CPA firm can perform the examination under AICPA standards, and we say so at the start of every engagement. What we do is everything around the examination that makes a bridge letter truthful and easy to produce: readiness assessment before the first audit, remediation of gaps, continuous evidence collection during and between review periods, and the drafting and evidence packaging of the letter itself. Craig Petronella, founder of Petronella Technology Group, is a CMMC Registered Practitioner, holds CCNA and CWNE certifications, is a North Carolina Licensed Digital Forensics Examiner (license 604180-DFE), completed MIT Sloan Executive Education in cybersecurity, and is the author of How Hackers Can Crush Your Business, which covers the vendor and third-party risks that SOC 2 programs exist to control.

No Letter vs. a Do-It-Yourself Letter vs. an Evidence-Backed Letter

SOC 2 Bridge Letter: Frequently Asked Questions

Related SOC 2 and Compliance Pages

Last Updated: September 13, 2026 (first published September 13, 2026). This page describes SOC 2 reports issued under the AICPA attestation standards and the Trust Services Criteria, and the management bridge letter practice that accompanies them. Gap acceptance ranges reflect common vendor risk and user auditor practice rather than a published standard; confirm the specific requirement with the customer or auditor who requested the letter. Written by Craig Petronella, CMMC Registered Practitioner, North Carolina Licensed Digital Forensics Examiner, and author of How Hackers Can Crush Your Business.