What it is
A complementary user entity control is a control that a service organization expects its customers to run. The customer is the user entity. The service organization lists these expectations in its SOC 2 report because its own controls only work when the customer does specific things. Example: the vendor enforces multi-factor authentication in its app, but relies on you to remove access when an employee leaves. The vendor cannot see your HR events.
CUECs appear in the system description or in a separate section of the report. They are not controls the service auditor tests at the service organization. The auditor gives an opinion on the service organization's controls. The CUEC list shows where those controls depend on your behavior. Your auditor, or your customer's auditor, can test your side.
Do not confuse CUECs with complementary subservice organization controls. A subservice organization is a vendor to your vendor, such as a data center or cloud host. A CUEC is always at the user entity: your company. One asks what your vendor's supplier does. The other asks what you do.
How it works
The service organization starts with its control matrix. For each control it asks: can we run this alone? If not, it writes down the customer action the control depends on. Good CUECs are specific. 'The user entity reviews privileged access quarterly' is useful. 'The user entity is responsible for security' is not. The auditor checks the wording against the system description.
In the report, CUECs are often grouped by Trust Services Criteria or by system component. You may see items such as configure single sign-on, restrict admin roles, review audit logs, notify the vendor when an employee leaves, approve data feed changes, set retention rules, or monitor integration jobs. Each item should tie to a risk the service organization has identified.
Turn each CUEC into an internal control with an owner and evidence. If the vendor requires quarterly access reviews, your control might be: the IT lead exports the user list, compares it to the HR roster, removes stale accounts, and saves the signed review. That record is what your auditor samples. Keep the matrix in your vendor file and update it when the next report arrives.
Why it matters for a business
CUECs draw the line between your vendor's controls and yours. A clean SOC 2 opinion does not mean your data is protected. It means the service organization's described controls worked during the report period, subject to the CUECs. If you skip a CUEC, the vendor's control may not cover you. Access removal is the usual example. The vendor can end a session, but only you know the person left.
Your own audits and customer questionnaires will ask about this. If you use a SaaS vendor that stores customer data, your SOC 2 auditor will ask how you monitor that vendor and meet the CUECs. If you sell a service, your customers will ask you for your CUECs. The term travels in both directions. A clear matrix saves time in both.
It also changes how you read a vendor contract. The security addendum may say the customer is responsible for user lifecycle management or for configuring logging. That is a CUEC in contract language. If your process does not match, you have a gap before any auditor finds it. Fix the process or document a risk decision with a date and an owner.
Common mistakes
The first mistake is treating the report as complete coverage. A service organization can have a clean opinion and still rely on you for access management. Read the CUEC section before you accept the report. If the report has no CUEC section, ask the vendor how its controls depend on customer actions. The answer may be in the system description.
The second is reading only the opinion page. The CUEC list is usually deeper in the report, near the system description or in an appendix. Pull it into a table and rewrite each item in your own words. If you cannot tell what action is required, ask the vendor. A vague CUEC is hard to test and hard to defend.
The third is copying CUECs into a policy without an owner or evidence. A policy sentence does not prove you did the review. Your auditor needs a record: who reviewed, what they checked, what they changed, and when. A quarterly access review with no export and no sign-off is just a claim. Link each CUEC to a ticket template or checklist. If you publish a SOC 2 report, write your own CUEC list and match it to how the product works.
How to get started
Get the current SOC 2 report and find the CUEC section. Build a matrix with columns for the CUEC text, the Trust Services Criteria, your control, the owner, the evidence, and the review date. Keep it with your vendor risk records. Use the same columns for each vendor.
Walk the matrix with the people who do the work. Mark each CUEC met, partly met, or not met. Partly met needs a fix or a written risk decision. Met needs a named evidence source. Then set review dates. Quarterly access reviews and annual vendor reviews belong on a calendar, not in someone's memory.
Add the CUEC review to procurement and renewal. Before you sign a new vendor, ask for the latest report and the CUEC list. At renewal, ask what changed, including any new subservice organization. Put the answer in the vendor file. If you want help turning the list into controls, Cloudverg's SOC 2 readiness assessment is $7,500/month and runs three weeks. It includes a gap assessment, a policy and evidence inventory, and a remediation roadmap. Compare that with your auditor's advice and any compliance tool you already own.
Frequently asked questions
What are complementary user entity controls in a SOC 2 report?
They are controls that a service organization expects its customers, called user entities, to perform. The report lists them because the service organization's controls rely on those customer actions. Examples include removing access for departed employees, reviewing admin roles, or configuring logging.
Who is responsible for complementary user entity controls?
Your company is responsible. The service organization can describe the dependency and give you tools, but it cannot run your access reviews or see your HR events. Assign each CUEC to an owner, tie it to an internal control, and keep evidence.
Are complementary user entity controls tested by the service auditor?
Usually not. The service auditor tests the service organization's controls and reads the CUEC list for consistency. Your auditor tests your side when your own SOC 2 report is audited. A customer's auditor may also test your controls during a vendor review.