SOC 2 Bridge Letters: Covering the Gap for US Customers

• Done for you, end to end

  We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.

• Simple and quick

  A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.

• 8,100+ client engagements

  In 60+ countries over 20+ years, with experts who bring 30+ years of experience.

• Under US$10,000, all-inclusive

  For most start-ups and SMEs: SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001, including the independent audit. A fixed quote follows a free gap assessment.

Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:

• Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
• Sterling Academy: preferential course access, with complimentary awareness training for your people.
• Internal auditor training for your audit team, as applicable to your standard.
• For information-security engagements, a vulnerability assessment.

These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.

Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.

Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.

What the fee covers, and what it doesn't:

• It is the fee for your first SOC 2 report or your first certification only.
• Annual work is always additional and billed the following year: later SOC 2 report periods, and ISO surveillance and recertification audits.
• It assumes a typical start-up or SME scope: one product or service and one main location.
• Larger or multi-site scopes get a fixed quote after the gap assessment.
• PCI DSS is quoted separately: a fixed quote follows a free gap assessment.

^[1] Occupational Employment and Wage Statistics, May 2025: 15-1212 Information Security Analysts, national annual median wage. US Bureau of Labor Statistics. accessed October 23, 2026.

The outcome. Your US customer's annual vendor review closes on time, with no awkward months and no stalled renewal.

A SOC 2 report speaks to a period that has already ended. When a US customer runs its yearly review a few months later, it wants to know what happened since. That need is often built into the customer's own obligations:

• Financial institutions under the FTC Safeguards Rule. They must periodically assess service providers based on risk and the continued adequacy of their safeguards^[5].
• SEC-registered companies. Their annual disclosure describes whether they have processes to oversee and identify cybersecurity risks from third-party service providers^[6].

Neither rule names SOC 2 or bridge letters. In Sterling's experience, a short, accurate bridge letter is how many US suppliers answer the "since your report" question until the next report is issued.

The outcome. You hand over the right document and never overstate what was examined.

• What it is. A one-page statement, also called a gap letter, covering the time from the end of your latest report period to the letter date.
• Who signs it. In common practice, an authorized officer of your company, not the CPA firm.
• What it is not. A test, an opinion or an extension of the report. It adds no assurance from the CPA firm.

The AICPA includes bridge letters among the topics of its SOC 2 report walkthrough course for service organization management and report users, alongside exceptions and opinion types^[2]. Its form is set by market practice; the guidance on this page is Sterling's own.

• The management representation letter. The AICPA publishes an illustrative version for SOC 2 engagements^[3]. Management gives it to the CPA firm during the examination; it stays in the engagement file. A bridge letter travels the other way, from you to a customer, after the report exists.
• The report itself. The CPA firm's opinion covers the dates stated in the report and nothing after them^[4]. No letter stretches that opinion forward.

The outcome. The conversation keeps moving while your next report is in progress.

• Annual review timing. A customer's review lands after your period closed and before the next report is issued.
• Change confirmation. Procurement wants confirmation that nothing material changed in your controls since the report date.
• Renewal under negotiation. A contract renewal is under discussion while your next examination runs.

No law and no AICPA standard cited here requires one. Whether a customer accepts a letter is the customer's call, so ask first.

Every line must be true on the day it is signed:

1. Company and system. The legal name and the system the report covers. 2. Latest report. Its period and issue date. 3. Gap covered. From the end of the report period to the letter date. 4. Change statement. Whether management is aware of material changes to the system or controls, or incidents that would affect the report's conclusions, and if so, what happened and what was done. 5. Next report. When the next period ends and the status of that examination. 6. Signature. An authorized officer's name, title and date.

Keep it to a page. Every extra sentence is one more statement you will be held to.

• It cannot say controls operated effectively during the gap; nobody tested them.
• It cannot promise a clean next report.
• It cannot suggest the CPA firm reviewed anything after the period closed.
• It cannot stay silent about a material change, such as a new cloud provider, a migration or a significant incident.

If something changed, state it plainly with what you did about it. US reviewers trust a candid letter more than a polished one, and a misleading letter is far worse than none.

The outcome. No uncovered months, so the bridge-letter request rarely comes up.

When each report period starts the day after the last one ends, there is no gap to explain. Our SOC 2 timeline guide shows how to set that up, and the Type 1 vs Type 2 guide explains how periods work.

Two cases call for something else. If your last report is more than a year old, the answer is a current report. If you have no report yet, there is nothing to bridge: offer policies, a completed questionnaire, a trust center page, a dated plan and, once signed, the engagement with the CPA firm.

Open by naming the company and the system, then the latest SOC 2 report's period and issue date. Next, state the dates the letter covers. Then say that, to management's knowledge, there have been no material changes to the system or its controls and no incidents that would alter the report's conclusions, or describe what did change. Close with the planned end of the next report period, followed by the officer's name, title, signature and date.

"To management's knowledge" carries weight only when someone has checked: incident logs, change tickets, access reviews and vendor changes should all be reviewed before signing.

Effivity, included with a full-year subscription, holds your report-period calendar and the evidence behind it, so you see a gap coming months ahead. When a customer requests a letter, we help management draft it, check each statement against current records and file a dated copy. Your management signs it. The SOC 2 report itself is issued by a US-licensed CPA firm, as AICPA standards require, and we coordinate that examination for you.

This is Sterling's recommendation, not an AICPA rule:

1. Plan overlapping report periods so a bridge letter is the exception. 2. When one is needed, keep it to a page and make every sentence verifiable. 3. Check incident logs and change records before an authorized officer signs. 4. Never present the letter as the CPA firm's work or as part of the report. 5. Log every letter issued: date, recipient and period covered. 6. Budget the next period early; our cost guide explains how later periods are billed.

Renewal season coming up? Get started, and we will set your next period so no gap opens.

A SOC 2 engagement has one deliverable that no consultant can hand you: the report. The SOC 2 report is issued by a US-licensed CPA firm, as AICPA standards require^[1]. What Sterling does is make sure you get there ready, and that nothing between today and the report lands on your desk.

With Sterling, you deal with one team from start to finish. We coordinate:

• a readiness review and a gap assessment against the Trust Services Criteria;
• the policies, procedures and controls you need, written for how your company actually works;
• evidence collection, so the examination does not become a scramble;
• an internal audit before the examiner arrives, carried out by people who did not advise you on the controls;
• the Type 1 or Type 2 path that fits your deal timeline, and the examination itself, including scheduling, requests and follow-ups.

Our experts bring 30+ years of experience, and the firm has completed 8,100+ client engagements in 60+ countries over 20+ years. You get a single plan, a single point of contact and a clear view of what happens next.

^[1] SOC (System and Organization Controls) Suite of Services. AICPA & CIMA. accessed October 23, 2026.

• SOC 2: standard overviewStandard overview
• Clear US Enterprise Security Reviews and Questionnaires FastUnited States
• SOC 2 Timeline for US Start-ups: How Long Each Stage TakesUnited States
• SOC 2 Type 1 vs Type 2: Which Report US Buyers ExpectUnited States
• SOC 2 Cost for US Start-ups: What You Pay and What Changes ItUnited States
• Sterling in the United StatesUnited States

1. SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy. AICPA & CIMA. accessed October 26, 2026.

2. SOC 2 Report Walkthrough. AICPA & CIMA. accessed October 26, 2026.

3. Illustrative Management Representation Letter: SOC 2 Type 1. AICPA & CIMA. accessed October 26, 2026.

4. Illustrative Service Auditor's SOC 2 Type 2 Report. AICPA & CIMA. accessed October 26, 2026.

5. 16 CFR 314.4 Elements (Standards for Safeguarding Customer Information). eCFR, Office of the Federal Register. accessed October 26, 2026.

6. 17 CFR 229.106 (Item 106) Cybersecurity. eCFR, Office of the Federal Register. accessed October 26, 2026.

The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.

Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.

Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.

Standards and marks named on this site belong to their respective owners.