What it is
A SOC 2 bridge letter is a short management statement that covers the gap between the end of your last SOC 2 report period and a later date. It says the controls described in that report have not changed in a material way. People also call it a gap letter or comfort letter. It is not a new SOC 2 report, and it carries no audit opinion.
The letter usually runs one page. It names the report it extends, the systems and Trust Services Criteria in scope, the date range it covers, and the person who signed it. It may note specific changes, such as a new ticketing system or a moved data center, so the reader can judge the impact. That detail matters because a customer's auditor will read it next to the original report.
A bridge letter is written by your management, not by your CPA firm. Your auditor does not test it or approve it. That is the main reason some customer auditors accept it and some do not. It is a communication tool, not evidence that controls operated during the gap.
How it works
Suppose your Type II report covers January 1 to December 31. In March, a customer asks for current assurance while your next audit is still in progress. You issue a bridge letter dated in March that covers January 1 through the date of the letter. The letter points to the December report and affirms that the control environment remains materially the same.
The wording should be specific. List the report title, report date, period covered, system boundaries, and any subservice organizations. State whether controls, scope, and key personnel changed. If you replaced your identity provider or changed your change management process, say so. A vague letter that claims no changes when your stack moved is worse than no letter.
Keep the process controlled. Use a template, require security and legal review, assign one signer, and log each letter by customer and date. Do not backdate. Do not issue an open-ended letter that says controls will stay the same forever. Reissue only after you confirm current facts. A customer's auditor may ask follow-up questions, so keep the evidence that supports the statements.
Why it matters for a business
Sales and vendor reviews do not stop when your report period ends. Procurement teams often review a report months later. If the report looks stale and no next report is ready, the customer may pause the deal or add contract conditions. A bridge letter gives them a dated statement to evaluate in the meantime.
It also helps your own team. Writing one forces you to check whether controls still match the report. You catch drift early, before the next audit. That is useful when you have changed tools or grown headcount and have not updated procedures.
The letter does not replace a report. It will not satisfy a customer who requires a report that covers the current period. It is a holdover while the next report is being produced. Treat it as a narrow tool for a narrow gap.
Common mistakes
The biggest mistake is presenting a bridge letter as audited. It is not. If your sales team calls it a SOC 2 report or implies the auditor reviewed it, you create an expectation you cannot meet. Use the exact name and explain the limits.
Another mistake is claiming no changes without checking. A new cloud provider, a changed backup process, or a reorganized security team can be material to a reader. Write down what changed, why, and how controls still cover the criteria. If you are unsure, ask your auditor or the customer's auditor.
Weak dates and signatures cause rejections. A letter with no clear start date, no end date, or no named signer looks informal. So does a letter signed by someone without authority. Get the wording reviewed once, then reuse it with current facts. Do not let a template go stale.
How to get started
Open your last SOC 2 report and find the period end, scope, and system description. Ask the customer or their auditor what they need the letter to say. Some want a specific addressee, a notarized signature, or a list of subservice organizations. Capture that before you draft.
Build a one-page template with fields for report reference, gap dates, scope, changes, and signer. Have security and legal review it. Set a reminder before your report gets old, and track requests in the same place you track security questionnaires. Do not wait for a deal to stall.
If you need help getting the underlying controls in shape, Cloudverg's SOC 2 readiness assessment is $7,500/month. It covers scoping, a gap assessment, a policy and evidence inventory, and a remediation roadmap. Other options include working directly with an auditor or using a compliance tool. Pick based on how much internal time you can spare.
Frequently asked questions
Is a SOC 2 bridge letter the same as a SOC 2 report?
No. It is a management statement that points to your last report and covers the time after the report period. It has no audit opinion and no testing of controls. Customers may accept it as interim evidence, but it does not replace a report.
Who signs a SOC 2 bridge letter?
Someone with authority over the controls and the facts in the letter, such as the CTO, CISO, or CEO. The signer should be able to confirm scope, changes, and incidents. Your auditor does not sign it.
How long is a SOC 2 bridge letter valid?
It is valid for the date range it states, not forever. Most letters cover from the report period end to the date of signing or a stated cutoff. Reissue it when facts change or when the customer needs a later date.