Templates · Last updated 2 October 2026 · 7 min read

SOC 2 management assertion: two letters you can copy

Section 2 is a one page letter, and a person at your company signs it. Here are both versions, free to copy or download.

The SOC 2 management assertion is your company’s own statement, printed as Section 2 of the report.1 It says the system description is accurate and the controls were designed well. An officer signs it, not the auditor, and it fits on one page.

Both versions are below, filled in for an example company. The Word and PDF download has the same wording with brackets for your names, dates and scope.

What the letter says in plain words

Three claims, in order. We wrote the description of our system. We are responsible for the controls in it and for picking the criteria. Those controls were suitably designed, and in a Type 2, they also worked across the whole period. The CPA firm then gives its own view on whether your statement holds up. That split matters: the firm reports on your claim, it does not make the claim for you.

Because it is your claim, overreaching costs you. Every extra category or system named in the letter is more evidence to produce and more for the firm to test.

Copy this: the Type 1 letter

A Type 1 speaks about a single day. It says nothing about how controls behaved in the weeks before or after. Swap in your company, product and dates.

Assertion of the management of Northwind Labs, Inc.

We have prepared the accompanying description of the Northwind scheduling platform system as of August 31, 2026 (description) based on the criteria for a description of a service organization's system set forth in DC section 200, 2018 Description Criteria for a Description of a Service Organization's System in a SOC 2 Report (description criteria). The description is intended to provide report users with information about the Northwind scheduling platform system that may be useful when assessing the risks arising from interactions with it, particularly information about system controls that Northwind has designed and implemented to provide reasonable assurance that its service commitments and system requirements would be achieved based on the trust services criteria relevant to the Security category (applicable trust services criteria) set forth in TSP section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy.

Northwind uses Google Cloud as a subservice organization. The description includes only the controls of Northwind and excludes the controls of Google Cloud. The description also indicates that certain applicable trust services criteria can be met only if complementary subservice organization controls assumed in the design of Northwind's controls are suitably designed and operating effectively, along with the related controls at Northwind. The description does not disclose the actual controls at the subservice organization.

The description also indicates that complementary user entity controls assumed in the design of Northwind's controls are necessary, along with controls at Northwind, to achieve Northwind's service commitments and system requirements. The description presents those complementary user entity controls and does not disclose the actual controls at the user entities.

We confirm, to the best of our knowledge and belief, that:

a. the description presents the Northwind scheduling platform system that was designed and implemented as of August 31, 2026 in accordance with the description criteria.

b. the controls stated in the description were suitably designed as of August 31, 2026 to provide reasonable assurance that Northwind's service commitments and system requirements would be achieved based on the applicable trust services criteria, if its controls operated effectively as of that date, and if the subservice organization and user entities applied the complementary controls assumed in the design of Northwind's controls as of that date.

Ravi Menon, Chief Technology Officer, Northwind Labs, Inc. Signed September 21, 2026.

Notice the two dates. August 31 is the day the letter describes. September 21 is when it was signed, which is also the day the report came out.

Copy this: the Type 2 letter

A period takes the place of the date, and a third point joins the first two: the controls operated effectively. The promise gets much bigger. “Throughout the period” covers every day in the window, and the firm tests samples from across it.

Assertion of the management of Northwind Labs, Inc.

We have prepared the accompanying description of the Northwind scheduling platform system throughout the period March 1, 2026 to August 31, 2026 (description) based on the criteria for a description of a service organization's system set forth in DC section 200, 2018 Description Criteria for a Description of a Service Organization's System in a SOC 2 Report (description criteria). The description is intended to provide report users with information about the Northwind scheduling platform system that may be useful when assessing the risks arising from interactions with it, particularly information about system controls that Northwind has designed, implemented and operated to provide reasonable assurance that its service commitments and system requirements were achieved based on the trust services criteria relevant to the Security category (applicable trust services criteria) set forth in TSP section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy.

Northwind uses Google Cloud as a subservice organization. The description includes only the controls of Northwind and excludes the controls of Google Cloud. The description also indicates that certain applicable trust services criteria can be met only if complementary subservice organization controls assumed in the design of Northwind's controls are suitably designed and operating effectively, along with the related controls at Northwind. The description does not disclose the actual controls at the subservice organization.

The description also indicates that complementary user entity controls assumed in the design of Northwind's controls are necessary, along with controls at Northwind, to achieve Northwind's service commitments and system requirements. The description presents those complementary user entity controls and does not disclose the actual controls at the user entities.

We confirm, to the best of our knowledge and belief, that:

a. the description presents the Northwind scheduling platform system that was designed and implemented throughout the period March 1, 2026 to August 31, 2026 in accordance with the description criteria.

b. the controls stated in the description were suitably designed throughout the period March 1, 2026 to August 31, 2026 to provide reasonable assurance that Northwind's service commitments and system requirements would be achieved based on the applicable trust services criteria, if its controls operated effectively throughout that period, and if the subservice organization and user entities applied the complementary controls assumed in the design of Northwind's controls throughout that period.

c. the controls stated in the description operated effectively throughout the period March 1, 2026 to August 31, 2026 to provide reasonable assurance that Northwind's service commitments and system requirements were achieved based on the applicable trust services criteria, if complementary subservice organization controls and complementary user entity controls assumed in the design of Northwind's controls operated effectively throughout that period.

Ravi Menon, Chief Technology Officer, Northwind Labs, Inc. Signed September 21, 2026.

Name only the categories you scoped. For most first reports that is Security, the common criteria.4

Sentences to add when they apply

Both letters above already carry a paragraph for one cloud vendor, and both assume a clean result. Change the vendor paragraph to match your method, and add the exception clause only if a control actually failed. An unneeded qualifier only raises questions.

You rely on vendors you cannot test

Pick one method and state it. The letters above use a carve out, which keeps the vendor’s controls out of scope:

Carve out

Northwind uses Google Cloud as a subservice organization. The description includes only the controls of Northwind and excludes the controls of Google Cloud. The description also indicates that certain applicable trust services criteria can be met only if complementary subservice organization controls assumed in the design of Northwind's controls are suitably designed and operating effectively, along with the related controls at Northwind. The description does not disclose the actual controls at the subservice organization.

The inclusive method brings them in, with one line: “The description includes the controls of Google Cloud relevant to the system, and those controls were examined.” That means the vendor must sign its own assertion and be tested next to you. A small company rarely gets a hyperscaler to agree, so carve out is the normal choice. The system description template carries the same choice into Section 3.

A control did not operate as described

Keep the letter and add a qualifier that points to where the detail lives. Section 4 holds the tests and results.3 In a Type 2, point c becomes:

The except for clause, Type 2

c. except for the matter described in Section 4 of this report, the controls stated in the description operated effectively throughout the period March 1, 2026 to August 31, 2026 to provide reasonable assurance that Northwind's service commitments and system requirements were achieved based on the applicable trust services criteria, if complementary subservice organization controls and complementary user entity controls assumed in the design of Northwind's controls operated effectively throughout that period.

Say it once. Explanations belong in Sections 4 and 5, not here. Whether the gap changes the opinion is the firm’s call, covered in what an exception does to a report.

Two letters people mix up with this one

Searches treat these as the same document. They are not. Each has a different reader and a different date on it.

The management representation letter
Addressed to the CPA firm by name. It confirms you handed over everything relevant, including incidents and known failures, as the attestation standards require.2 It stays in the firm’s file and speaks as of the date of the firm’s report.
The bridge letter
Something you write yourself after the report, to cover the months since the period ended. Nobody examined it, and it adds no assurance. The bridge letter guide has the wording.

Who signs, and what happens if they leave

The signer needs two things: authority to speak for the company, and real knowledge of how the system runs. A CEO, CTO or CISO fits. A consultant can help with the words but cannot sign. The auditor never signs, because a firm that wrote your assertion would be judging its own work. Who can perform a SOC 2 audit covers that line.

The letter is dated on the issue date, which can land weeks after the period closes. If the officer leaves in between, their successor signs for the company. Prepare for that: have the departing officer write a dated handover memo listing systems, open issues and where the evidence lives. Tell the firm early who will sign, and confirm that person’s authority with it before the engagement closes. Never backdate, and never use a signature from someone already gone.

The letter claims your controls were suitably designed, and that design is written down in your policies. The information security policy names who owns them. The access control policy and the incident response plan describe controls the examination then tests against the records of the period.

What this letter costs you

The letter itself costs nothing. It is a page of standard wording plus your details, and you can write it from this template. The spending is in everything it points to: the description, the evidence and the examination.

cybersoftware drafts Section 2 from your questionnaire answers, with your signer, title and dates, and files it with the evidence behind it in the package your independent partner auditor reviews. Onboarding is $2,000 one time. Or choose $4,000 one time, which adds the SOC 2 Type 1 examination and report with the auditor fee included. Type 2 is $600 a month on a 12-month term, and your first SOC 2 Type 2 audit is included in the term. It starts once the 3-month observation window completes. Start with the free readiness assessment or see every price on pricing.

cybersoftware is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Questions

What is a SOC 2 management assertion?
A one page letter in Section 2 of the report. In it your company states that the system description is accurate and that the controls were suitably designed, and for a Type 2 that they also operated effectively across the period. An officer signs it. The CPA firm then reports on whether that statement is fairly presented.
How is it different from the management representation letter?
The assertion is printed in the report for every reader. The representation letter is addressed to the CPA firm, gives the written confirmations the firm needs before it can finish, and is never published. The assertion speaks about the system as of the Type 1 date or across the Type 2 period. The representation letter speaks as of the date of the firm's report, and the time management actually signed is recorded separately.
Who should sign the assertion?
An officer who can speak for the company and who understands how the system runs, such as the CEO, CTO or CISO. Their title appears under the name. The auditor never signs it, and neither does a consultant who helped write it.
What changes between the Type 1 and Type 2 wording?
A Type 1 letter confirms two things as of one date: the description presents the system according to the description criteria, and the controls were suitably designed. A Type 2 letter confirms both across a stated period and adds a third, that the controls operated effectively throughout it. That is a claim about every day in the window.
Our signer left before the report was issued. What now?
Check the new signer's authority with the CPA firm before it finishes the engagement. A successor can sign for the company about a period they were not there for, which is why a handover memo and readable evidence matter. Keep three dates apart: the examination date or period, the date of the firm's report, and when the signature was actually given. Never backdate, and never treat an earlier signature from someone who has left as current.

Sources

  1. SOC 2 Report AICPA. What a SOC 2 report is and who may issue one. Checked 1 August 2026.
  2. Statements on Standards for Attestation Engagements AICPA. The attestation standards a SOC 2 examination is performed under. Checked 1 August 2026.
  3. SOC 2: Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy AICPA. The implementation guide practitioners work from, including sampling and the assertion. Checked 1 August 2026.
  4. TSP Section 100, Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy AICPA. The criteria themselves, including the common criteria every SOC 2 report covers. Checked 1 August 2026.

Related

Get audit-ready without a compliance team

The readiness assessment is free, with no payment and no card. Onboarding is $2,000 one time, then SOC 2 Type 2 is $600 a month on a 12-month term, and your first SOC 2 Type 2 audit is included in the term. You can be audit-ready starting at about a week.

Start with a free readiness assessment

cybersoftware is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.