Exams or Audits

It is to the vendor's advantage to share the SOC 2 reports as those provide you the ability to review security posture without having to conduct all that audit work yourself. If they don't provide the SOC 2, then your contractual audit rights are more ... More

I perform third party assessments for public agency - local government, and within our policy, we do specify the following: SOC 2 (Type 2) If they do not have a SOC 2 or other external audit report I fully expect that the vendor will have ... More

Agree - SOC1 and SOC2 are provided by privately held companies if available, particularly ones keenly aware of business value they provide to FI and is indicative of strong partnership to support regulatory commitments. For private companies who avoid ... More

This is not true. I receive SOC 1s and SOC 2s from most of our privately held. However, financial statements are rare, so I ask for a Financial Condition Letter, which a Chief (or equivalent) needs to attest to – all of the privately helds provide these ... More

Hello I have been told that private companies are not required to share their financial statements. That does not stop me from asking for them though. Most of the time they will share with a signed NDA. I ask for the same documents from ... More