SOC 2 by industry
SOC 2 for managed service providers and data centres: privileged access, availability and your place in clients' reports
What changes when the service organisation is an MSP, MSSP, colocation or hosting provider: why clients and their auditors ask, what belongs in scope, where examiners sample, and how carve-out, inclusive and user-entity controls work for you.
Key points
- For a managed service provider, MSSP, colocation or hosting business, the SOC 2 report is often read by your clients' own CPA firms, because you are a subservice organisation in their reports.
- The system in scope is the service delivery platform itself: remote monitoring and management (RMM) tools, privileged access paths into client environments, the ticketing and change process and, for data centres, the data halls.
- Examiners sample privileged remote access, changes made in client estates, monitoring and incident response, and physical and environmental protection far more heavily than in a typical software company.
- Availability is the category most clients expect beside Security, and the complementary user-entity controls you hand to clients need to be written as carefully as your own.
Why managed service providers and data centres are asked for SOC 2
The request arrives in one of two ways. A client's vendor risk team asks for the report at onboarding or renewal, because your technicians hold administrative access to their servers, networks and cloud tenants. Or a client with its own SOC 2 report finds that your hosting, monitoring or security operations sit inside the system its auditor examines.
The second route changes the stakes: as a subservice organisation, your opinion and exceptions become evidence in someone else's examination. Some clients whose services touch financial reporting also ask for a SOC 1 report, on controls relevant to their financial reporting.
What sets this sector apart is reach: one RMM platform or privileged account touches many client environments, and one data-hall failure can take many clients offline. Clients read the report for that concentration risk.
What sits inside the scope for an MSP, MSSP or data centre
For a managed services business, the system description names the contracted services (monitoring, patching, backup, helpdesk, managed security), the RMM and remote access tools, the password vault, the ticketing and change system and the security operations tooling. For a colocation or hosting provider, it names the sites and data halls, access control and CCTV, power, cooling and environmental monitoring, and any remote hands or managed hosting.
Three scope mistakes recur: leaving out the RMM platform or remote access gateway, the most direct route into every client estate; describing a single site when clients are served from several data centres or a separate disaster recovery location; and forgetting your own suppliers: a colocation provider under a managed hosting service, or a cloud-hosted RMM tool, is often a subservice organisation of yours, disclosed with its own carve-out or inclusive treatment. Boundary rules are in SOC 2 scope: system boundaries, trust services categories and carve-outs.
Where the criteria bite for managed services and data centres
| Criteria area | What it means for an MSP or data centre | Evidence the examiner samples |
|---|---|---|
| CC6 Logical and physical access | Who can reach client environments through RMM, remote access and shared administrative accounts, and who can enter the data halls | Vaulted credentials and session records, per-client access reviews, leaver removal, multi-factor authentication on RMM, badge logs, visitor records, cage access lists |
| CC8 Change management | Changes your engineers make to client systems, patching and scripts pushed from RMM, and changes to your own platform | Change tickets with client approval where required, patch deployment records, script review before mass deployment, emergency changes reviewed afterwards |
| CC7 System operations | Monitoring client estates and your own platform, and responding to alerts and incidents within the contract | Alert and on-call records, incident tickets with response times, post-incident reviews, backup restore tests |
| A Availability | Meeting the uptime in your service agreements through capacity, environmental protection and tested recovery | Power and capacity monitoring, generator and UPS tests, environmental alarms, failover tests |
| CC9 Risk mitigation | Your dependence on upstream providers, carriers and the tools you run clients on | Supplier risk assessments, review of upstream providers' SOC reports and the controls they expect of you, contracts with security terms |
The full criteria set is explained in SOC 2 Trust Services Criteria explained, criterion by criterion.
Being a subservice organisation, and the controls you hand to clients
Your clients' auditors treat you in one of two ways. Under the carve-out method, your controls are excluded from their examination and the client shows it monitors you, largely by reading your report. Under the inclusive method, your controls are described and tested inside their report, which needs your cooperation and a written assertion from your management.
Your own report will also list complementary user-entity controls: the things clients must do for your controls to work. For an MSP these typically include approving changes, telling you promptly about their own leavers, protecting the credentials they hold and reviewing the reports you send. For a data centre, they include keeping the client's authorised access list current. Write them precisely; clients' auditors read them line by line. See How to read a SOC 2 report: opinion, exceptions and CUECs, and managing your own suppliers in SOC 2 vendor management and subservice organisations.
Working alongside ISO/IEC 27001, ISO 22301 and ISO/IEC 20000-1
Many clients also ask for ISO/IEC 27001 certification. ISO 22301 supports the availability criteria, and ISO/IEC 20000-1 covers incident, change, capacity and supplier disciplines. One risk assessment, one change process and one evidence calendar can serve all of them; see SOC 2 vs ISO/IEC 27001: which one, or both?
Duration depends on the services and sites in scope, whether privileged access is already vaulted and recorded, and when the anchor client needs the report. Service delivery, security operations, facilities and contract owners must be involved. With Design™, Sterling guides your teams to own the controls; with Drive™, Sterling carries more of the documentation, evidence and readiness testing.
How Sterling works with managed service providers and data centres
A report your clients' auditors can rely on.
Our expert and experienced consultants map the criteria to your RMM, vault, ticketing and facilities records, draft the user-entity controls with you, test the controls the way the CPA firm will before the period starts, and keep the evidence in Effivity, included with the engagement, at no additional cost. Sterling does not issue the report; an independent, licensed CPA firm examines and opines. We ensure a successful SOC 2 examination for our clients.
Book a free discovery callSOC 2 for managed service providers: questions buyers ask
Does an MSP need SOC 2 if its clients already have their own report?
Often yes. If your services are part of a client's system, their auditor needs evidence about your controls, and your own report provides it without every client auditing you.
Should Availability be in scope for a data centre or hosting provider?
Usually yes; uptime is what clients contract for. Include it once you can show capacity monitoring, environmental protection and tested recovery.
Does our colocation provider's SOC 2 report cover our managed hosting service?
No. It covers the facility controls the provider operates. Your own access, change, monitoring and backup controls are yours to evidence, and the provider is disclosed as your subservice organisation.
How do examiners test RMM and remote access tools?
They sample who holds access, how it was approved and removed, whether multi-factor authentication was enforced, and whether sessions and mass deployments were recorded and reviewed during the period.
SOC 2 by industry
Every guide in the SOC 2 series is written for one question and links back to the hub for the whole picture.
- SOC 2 for accounting and professional services
- SOC 2 for BPO and shared services
- SOC 2 for fintech and payments
- SOC 2 for healthcare IT and health BPO
- SOC 2 for HR, payroll and staffing
- SOC 2 implementation plan
- SOC 2 in India
- SOC 2 for managed service providers and data centres
- SOC 2 in the Netherlands and Europe
- SOC 2 policies and evidence
- SOC 2 readiness review checklist
- SOC 2 for SaaS and technology
Keep exploring
Explore more about SOC 2
Watch a video on how to implement SOC 2 here.
Watch a video on SOC 2 requirements here.
SOC 2 resources
Services for SOC 2
Industries
Talk to a consultant
Plan a SOC 2 report your clients and their auditors will accept.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice