Vendor Risk

Your Vendor Won't Share Their SOC 2 Report. Here's What to Document Instead.

Your vendor won't release their SOC 2 Type II report. Here's the evidence package auditors accept instead, and the exception record that makes it hold.