SOC 2 Subservice Carve-Out vs Inclusive Method

What Are Subservice Organisations?

A subservice organisation is a service provider that your company uses in providing your service to customers, and whose services are part of your system. For most SaaS companies, the primary subservice organisations are cloud infrastructure providers (AWS, GCP, Azure).

Because these providers control physical infrastructure, network, and virtualisation layers that your application depends on, the controls at the subservice organisation affect your system's Trust Services Criteria. Your SOC 2 report must address how these external controls are handled.

The Carve-Out Method

Under the carve-out method, your SOC 2 report excludes the subservice organisation's controls from scope. Your auditor tests your controls (the application layer and above), and the subservice provider's SOC 2 report covers the infrastructure controls.

The carve-out method is the standard approach for SaaS companies using AWS, GCP, or Azure. These providers maintain their own comprehensive SOC 2 Type II reports that are available to their customers. AWS's SOC 2 report is available via AWS Artifact; Google Cloud's is available on their Compliance Reports Manager.

Your system description must: identify AWS as a subservice organisation, describe which controls are carved out (physical access, hardware maintenance, network infrastructure), and note that users of your report can obtain AWS's SOC 2 report for additional assurance over those carved-out controls.

The Inclusive Method

Under the inclusive method, your auditor tests the subservice provider's controls as part of your engagement. This is extremely rare for large cloud providers — AWS cannot allow individual customer auditors to independently test their data centres.

The inclusive method is occasionally used when the subservice provider is a smaller, more accessible provider who agrees to be included in the audit scope, and when the provider's controls are highly specific to your service. For most SaaS companies, the inclusive method is not applicable.

Which Method to Use

Use carve-out if: your subservice provider has their own SOC 2 Type II report that customers can access (virtually all major cloud providers), or your subservice provider maintains another recognised compliance certification that addresses the relevant controls.

Use inclusive if: your subservice provider is a smaller company without their own SOC 2 report, the provider agrees to be included in your audit scope, and including their controls adds material assurance for report users.

For the vast majority of B2B SaaS companies using AWS as their primary infrastructure: carve-out method, reference AWS SOC 2 Type II from AWS Artifact.

System Description Requirements

Your system description (Section III of the SOC 2 report) must include a clear statement of which subservice organisations are used and the method (carve-out or inclusive) applied.

Sample carve-out language: "[Company] uses Amazon Web Services (AWS) as a subservice organisation for hosting the [Product Name] infrastructure. AWS is responsible for physical security of data centre facilities, hardware maintenance, and network infrastructure. The company applies the carve-out method with respect to AWS's controls. Users of this report may request AWS's SOC 2 report from AWS Artifact at aws.amazon.com/compliance/soc-faqs."

Complementary User Entity Controls

When you use the carve-out method, the subservice provider's SOC 2 report typically includes Complementary User Entity Controls (CUECs) — controls that users of the report (your company) must implement to achieve the security objectives. You are responsible for implementing these CUECs.

AWS CUECs typically include: configuring IAM roles and policies appropriately, enabling CloudTrail and CloudWatch, encrypting data at rest and in transit, and configuring security groups and network ACLs. Your own SOC 2 report's control descriptions should address how you have implemented the applicable CUECs from your subservice providers.