Skip to content

SOC 2® vendor risk and continuity in plain English (CC9)

Unofficial plain-English guide. Not affiliated with or endorsed by the AICPA. Read the AICPA’s own criteria

An unofficial plain-English look at SOC 2 criteria CC9.1 and CC9.2: planning for disruption, and managing the vendors and partners you depend on.

By Blank Slate Creative.

OrderFive custom security policies, $85 flat. Markdown, Word, and PDF.

Order the five policies

What happens when something outside your control stops working?

CC9 has two criteria with one theme: depending on things you don’t fully control. One concerns disruptions to the business in general, the other the vendors and partners you rely on.

The vendor half is the one customers feel. Their questionnaires ask for your vendor list, how you choose vendors, and whether you read their reports. A short, current inventory beats a long, stale one.

Where a small team starts

List every vendor that touches customer data or that you couldn’t run without. For each, write what it does, what data it sees, who owns the relationship, and the last time someone looked at its security report or terms.

Sort them into critical and routine, and do the real reading only on the critical ones. Then write half a page on what you would do if your cloud provider were down for a day.

The criteria, CC9.1 to CC9.2

Below are our short labels, what the criteria are about, and examples of what a small team might do or keep. The examples are our own views, not requirements of the standard.

CC9.1: Planning for business disruption

The company plans for events that could interrupt the business and reduces that risk with continuity plans, redundancy, and insurance. It isn’t limited to technology failures.

In practice

  • A short continuity plan covering the loss of a key vendor, the office, or a key person.
  • A summary of the cyber insurance policy kept on file.
  • A list of single points of failure, each with a decision about what to do.

CC9.2: Managing vendor and partner risk

Before and while relying on vendors and partners, the company looks at what they could affect, checks them in proportion, and keeps contracts and reviews current.

In practice

  • A vendor list with the data each one sees, an owner, and a risk tier.
  • Security reports or questionnaire answers collected and read for the critical vendors.
  • Security and data terms in each important contract.
  • A step for ending a vendor relationship, including getting data back or deleted.

Questions worth being able to answer

These are ours, not a list of what an examiner will ask. If you can answer each in a sentence, and show where the proof lives, you are in good shape for the conversation.

  • Which vendors can see customer data?
  • What did you check before you signed the last one?
  • What would you do if your cloud provider had a day-long outage?
  • Who reads vendor SOC 2 reports, and what happens with the exceptions they list?
  • Do you carry insurance for this?

More topics in this guide

This page is one part of our unofficial guide to the SOC 2 Trust Services Criteria. Here are the others.

Related guides

About this guide and the study tool

Who we are, and aren’t

Blank Slate Creative, LLC is not affiliated with, endorsed by, or sponsored by the AICPA, CIMA, or the Association of International Certified Professional Accountants. We are not a CPA firm. Only a licensed CPA firm can perform a SOC 2 examination and issue a report.

What this is, and isn’t

This is an unofficial, plain-English explanation written by Blank Slate Creative, LLC. It is not the Trust Services Criteria, and it does not reproduce or replace them.

It is not legal, audit, or attestation advice.

Using this guide or the study tool does not mean you will pass an audit or satisfy any customer or auditor.

The “in practice” notes and examples are our own views, not requirements of the standard.

Written about the 2017 criteria with the 2022 revised points of focus. The AICPA may revise them.

Read the AICPA’s own publication for the authoritative wording. The PDF download asks for a free AICPA account.

Trademarks

AICPA and American Institute of CPAs are trademarks of the American Institute of Certified Public Accountants and are registered in the US, the EU and other countries.

SOC 1®, SOC 2® and SOC 3® trademarks are registered trademarks of the AICPA.

← All guides