SOC 2 bridge letter: what it is and how to write one

You finished your SOC 2 audit, sent the report to a prospect, and their security team replied with one more request: “Please also provide a bridge letter.” If you haven't written one before, the request can sound like another audit. It isn't. A bridge letter is a short statement from your own management, and you can usually write it in an afternoon.

This guide explains what a bridge letter is for, what to put in it, what not to promise, and when a buyer will want more than a letter.

Why buyers ask for one

A SOC 2 Type II report covers a fixed period in the past, for example January 1 to June 30. The auditor's opinion only covers that period. When a buyer reviews you in October, there is a gap of several months that no report covers.

A bridge letter (sometimes called a gap letter) covers that gap. In it, your management states whether anything material has changed in the systems and controls the report described, from the end of the report period to a recent date. The buyer files it next to the report, so their review has no unexplained hole.

If you don't have a SOC 2 report at all, a bridge letter doesn't apply. Our guide to the SOC 2 question covers how to answer when you have no report yet.

Who signs it, and what it is not

Your company writes and signs the bridge letter, usually a senior leader such as the CEO, CTO or head of security. Your auditor does not sign it. The auditor's work is limited to the period they examined, so they can't give assurance on months they didn't test.

That shapes what the letter can say. Management can state that it is not aware of material changes or control failures since the report period ended. It can't claim that controls were tested or proven effective during the gap. A letter that sounds like an audit opinion overstates what it is, and an experienced reviewer will notice.

What to include

• Your company name and the system or services the SOC 2 report covers
• The report type and the exact period it covered, with the auditor's name
• The gap period the letter covers: from the day after the report period ended to the date of the letter
• A statement on material changes: either that there have been none, or a short description of each
• A statement that you are not aware of any material control failures or security incidents affecting the system in that period (only if true)
• When you expect the next report, if one is planned and you can stand behind the date
• Name, title, signature and date

Keep it to one page. Buyers want a clear, dated statement, not a narrative.

What counts as a material change

There is no fixed list, but the question to ask is whether a buyer reading your SOC 2 report would now get a wrong picture of your controls. Changes that usually deserve a mention:

• A move to a new hosting provider or region
• A new subprocessor that handles customer data
• A major change to how customers sign in or how access is controlled
• A security incident that affected customer data
• A change in who owns security, or a large change in the team
• Dropping or replacing a control the report describes

Routine changes, such as normal software releases or a new employee going through your usual onboarding, generally don't need listing. If you are unsure, mention it briefly. A short, honest note costs little; a buyer discovering an unmentioned change later costs a lot more.

An example you can adapt

Replace everything in brackets, and delete any sentence that isn't true for you.

“[Date]. To [Customer name]: [Company] engaged [audit firm] to examine the controls of [system or service] for the period [start date] to [end date], resulting in a SOC 2 Type II report. This letter covers the period from [day after end date] to [date of letter]. During this period, there have been no material changes to the system or the controls described in that report[, except: brief description]. Management is not aware of any material failures of those controls or security incidents affecting [system] during this period. [Our next SOC 2 examination is planned to cover the period [dates].] This letter is a statement by [Company]'s management and is not an examination or report by our auditor. [Name], [Title], [Company].”

How long a gap can it cover?

No rule sets a maximum, but common practice is that a bridge letter covers a few months, often up to about three. Once the gap stretches much longer, many buyers start asking for a new report rather than accepting a letter, and some will accept a letter only alongside a date for the next audit.

If your gap is long, say so plainly and give the planned dates of your next examination, if they are confirmed. That is a better answer than a letter that quietly covers most of a year.

Keep your questionnaire answers consistent

Bridge letter requests often arrive in the same review as a security questionnaire. Make sure the two agree: if the letter says nothing material changed, the questionnaire shouldn't describe a new hosting provider. Reviewers compare them.

Our list of common questions with example answers and the guide to answering a security questionnaire help keep the wording consistent. When the questionnaire comes as an Excel or CSV file, Rendro drafts each answer from your own documents, including your SOC 2 report, and shows the source for every answer, which makes those checks quicker.