[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Compliance and Regulations](/category/compliance-and-regulations) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Meeting the SOC 2 Third-Party Requirements in 2026](/blog/soc-2-third-party-requirements) Publish date January 5, 2026 {x} minute read # Meeting the SOC 2 Third-Party Requirements in 2026 [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-third-party-risk-management) [Free trial](/demo) Written by [Catherine Chipeta](/team/catherine-chipeta) Cybersecurity Writer Catherine's work has influenced leaders in technology, SaaS, government, and financial services. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Third-Party Risk Management Free resource ### A Complete Guide to Third-Party Risk Management Learn how to protect your business with an effective cybersecurity program. [Download now](/resources/complete-guide-to-third-party-risk-management) Organizations trust [third-party vendors](https://www.upguard.com/blog/third-party-vendor) to manage large volumes of sensitive customer data, with outsourcing increasing across all industries, including the highly-regulated [healthcare sector](https://www.upguard.com/blog/cybersecurity-regulations-and-frameworks-healthcare) and [financial services](https://www.upguard.com/blog/cybersecurity-regulations-financial-industry). However, service providers don’t necessarily implement the same [strict data security standards](https://www.upguard.com/category/compliance-and-regulations) that these organizations do.  Cyber attacks targeting third parties are increasing, [according to Gartner](https://www.gartner.com/en/newsroom/press-releases/2022-06-21-gartner-unveils-the-top-eight-cybersecurity-predictio). Further, [IBM Security and Ponemon Institute’s](https://www.ibm.com/security/data-breach) 2022 Cost of a Data Breach Report found [third-party breach costs have increased](https://www.upguard.com/blog/cost-of-data-breach) from US$4.33 million to US$ 4.55 million. The first step in [preventing third-party data breaches](https://www.upguard.com/blog/prevent-third-party-data-breaches) is to perform a vendor risk assessment before onboarding. [SOC 2 certification](https://www.upguard.com/blog/soc-2) is an early indicator of whether a vendor will likely meet an organization’s security requirements or not.  Achieving compliance with the internationally recognized standard ensures that an organization has implemented effective [information security](https://www.upguard.com/blog/information-security) measures for protecting sensitive and [personal data](https://www.upguard.com/blog/personally-identifiable-information-pii) and preventing [data breaches](https://www.upguard.com/blog/data-breach). Aside from internal measures, organizations must also comply with specific [Third-Party Risk Management](https://www.upguard.com/blog/third-party-risk-management) requirements to achieve SOC 2 compliance.  This article details the third-party requirements of SOC 2 and how the UpGuard platform can help you implement and maintain each control as part of an [effective vendor risk management program](https://www.upguard.com/blog/vendor-risk-management-program). If you’re already familiar with SOC 2, [skip ahead to its third-party risk requirements](https://www.upguard.com/blog/soc-2-third-party-requirements#toc-2). ## What is SOC 2? [System and Organization Control (SOC) 2](http://v) is an auditing standard for [managing sensitive data](https://www.upguard.com/blog/sensitive-data), developed by [The American Institute of Certified Public Accountants (AICPA) Assurance Services Executive Committee (ASEC)](https://us.aicpa.org/). Its requirements are designed specifically for cloud-based service organizations, such as [SaaS providers](https://www.upguard.com/blog/saas-security-risks), software developers, and other technology services, to demonstrate they have adequate data protection controls to safeguard customer data. SOC 2 reporting varies between service organizations, depending on the internal practices and security controls they choose to implement to achieve compliance with the trust service principles. There are two types of SOC reports: * ‍**Type I:** The Type 1 report describes a vendor's system and organization controls and whether they suit relevant criteria.**‍** * **Type II:** The Type 2 report details the operating effectiveness of the systems outlined in the Type I report. Once issued, SOC 2 audit reports usually cover a 12-month period of time. [Learn more about the scope of SOC 2 >](https://www.upguard.com/blog/soc-2) ## What are the SOC 2 Compliance Requirements? Organizations must undergo an external SOC 2 audit process to achieve certification. Auditors assess compliance based on a service organization’s ability to satisfy AICPA's Trust Services Criteria (TSC). The five TSCs are as follows: 1. **Security: **The protection of system resources from unauthorized access. Such measures could include [network security](https://www.upguard.com/blog/network-security), [intrusion detection](https://www.upguard.com/blog/top-free-network-based-intrusion-detection-systems-ids-for-the-enterprise), and other security tools that protect against cyber threats, such as [software vulnerabilities](https://www.upguard.com/blog/vulnerability), data leaks, [ransomware](https://www.upguard.com/blog/ransomware), and other [types of malware](https://www.upguard.com/blog/types-of-malware). This principle aims to [prevent data breaches](https://www.upguard.com/blog/prevent-data-breaches) and other serious [cyber attacks](https://www.upguard.com/blog/cyber-attack).  2) **Availability: **The accessibility of systems, products, or services, either contracted or listed in the service level agreement (SLA). The scope of Availablity does not cover functionality and usability, instead focusing on security-related criteria that can affect availability.   3. **Processing integrity: **Addresses whether a system achieves its purpose in a complete, valid, accurate, timely, and authorized manner. 4) **Confidentiality: **Addresses whether [sensitive data](https://www.upguard.com/blog/sensitive-data) is restricted to specific people or organizations. Whereas the Privacy principle is only applicable to personal information, Confidentiality extends to various types of sensitive data, such as trade secrets and intellectual property.  5. **Privacy: **Addresses the collection, use, retention, disclosure, and disposal of [personally identifiable information (PII)](https://www.upguard.com/blog/personally-identifiable-information-pii) and its alignment with the organization's privacy notice and criteria set out in AICPA's Generally Accepted Privacy Principles (GAPP). Organizations must protect PII from both intentional and unintentional exposure. [Find out how to prepare for a SOC audit >](https://www.upguard.com/blog/unprepared-for-soc-audit) > **Important: **A SOC 2 report investment is only worthwhile if you know the [next steps to take after completing a SOC 2 audit](https://www.upguard.com/blog/soc-2-audit-next-steps). ## What are the SOC 2 Third-Party Requirements? The UpGuard platform can help you comply with the following third-party requirements of SOC 2’s Trust Services Criteria (TSC). > CC2.3 The entity communicates with external parties regarding matters affecting the functioning of internal control. * **Communicates Objectives Related to Confidentiality and Changes to Objectives** * **Communicates Objectives Related to Privacy and Changes to Objectives ** #### How UpGuard Helps With [UpGuard Vendor Risk](https://www.upguard.com/product/vendorrisk), organizations can assess, monitor, and manage their vendors' security posture throughout the lifecycle, with continuous monitoring, [instant security ratings](https://www.upguard.com/instant-security-score), and integrated remediation workflows. Built-in reporting allows security teams to communicate these insights clearly to all key stakeholders. [Try UpGuard free for 7 days >](https://www.upguard.com/demo) > CC3.2 The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed. * ** Analyzes Threats and Vulnerabilities From Vendors, Business Partners, and Other Parties ** #### How UpGuard Helps [UpGuard Vendor Risk](https://www.upguard.com/product/vendorrisk) continuously monitors vendors during the vendor management process for threats and vulnerabilities across six categories: website risks, email security, network security, phishing & malware, reputation risk, and brand protection. Identified risks are automatically categorized and assigned a criticality rating, enabling faster remediation. [Try UpGuard free for 7 days >](https://www.upguard.com/demo) > CC3.4 The entity identifies and assesses changes that could significantly impact the system of internal control. * **Assesses Changes in Vendor and Business Partner Relationships** #### How UpGuard Helps [UpGuard Vendor Risk](https://www.upguard.com/product/vendorrisk) allows organizations to track their vendors’ security postures over time, instantly alerting users of any changes in a vendor’s security score. UpGuard users can tier vendors based on the inherent risk they pose to an organization and manually adjust these tiers to suit changes in business relationships. The UpGuard platform displays tiered vendors in an exportable Vendor Risk Matrix, allowing security teams to visually convey the business impact of their organization’s vendor portfolio risk to executive management. [Try UpGuard free for 7 days >](https://www.upguard.com/demo) > CC9.2 The entity assesses and manages risks associated with vendors and business partners. * **Establishes Requirements for Vendor and Business Partner Engagements** #### How UpGuard Helps [UpGuard Vendor Risk](https://www.upguard.com/product/vendorrisk) centralizes the entire risk management process, including a pre-built questionnaire library of recognized compliance standards, such as PCI DSS and ISO 27001.  The Trust Page feature (formerly Shared Profile) allows organizations to [share their security posture proactively](https://www.upguard.com/product/trust-exchange/trust-page) by uploading completed security questionnaires, certifications, SLAs, and other related documentation, with current and prospective customers. [Try UpGuard free for 7 days >](https://www.upguard.com/demo) > CC9.2 The entity assesses and manages risks associated with vendors and business partners. * **Assesses Vendor and Business Partner Risks**  - **Assesses Vendor and Business Partner Performance** #### How UpGuard Helps [UpGuard Vendor Risk](#) continuously monitors vendors to identify emerging threats and vulnerabilities in real-time. Built-in executive reporting allows security teams to communicate the ongoing management of third-party cybersecurity risks with key stakeholders. Security and risk teams can leverage the pre-built questionnaire library of recognized compliance standards, such as PCI DSS and ISO 27001, and the Custom Questionnaire Builder, to monitor and assess third-party compliance throughout the vendor lifecycle. [Try UpGuard free for 7 days >](https://www.upguard.com/demo) > CC9.2 The entity assesses and manages risks associated with vendors and business partners. * **Implements Procedures for Addressing Issues Identified During Vendor and Business Partner Assessments** #### How UpGuard Helps UpGuard Vendor Risk is a fully integrated vendor risk management platform. Organizations can identify vendor risks and request remediation centrally in the UpGuard platform, with a built-in messenger to streamline communication.  > CC9.2 The entity assesses and manages risks associated with vendors and business partners. * **Implements Procedures for Terminating Vendor and Business Partner Relationships** #### How UpGuard Helps [UpGuard Vendor Risk](https://www.upguard.com/product/vendorrisk) centralizes vendor due diligence workflows, from onboarding to offboarding. Organizations can ensure terminated vendors are following offboarding procedures, such as procurement, compliance, and regulatory requirements, by leveraging the in-platform Custom Questionnaire Builder to create and send offboarding questionnaires. [Try UpGuard free for 7 days >](https://www.upguard.com/demo) > CC9.2 The entity assesses and manages risks associated with vendors and business partners. * **Obtains Confidentiality Commitments from Vendors and Business Partners** - **Obtains Privacy Commitments from Vendors and Business Partners ** #### How UpGuard Helps With [UpGuard Vendor Risk](https://www.upguard.com/product/vendorrisk), organizations can securely share confidentiality and privacy agreements with current and prospective customers within the platform with the Trust Page feature. Organizations can add NDA protection to their Trust Page to ensure potential customers agree to privacy and confidentiality terms before viewing internal documents.  [Try UpGuard free for 7 days >](https://www.upguard.com/demo) > CC9.2 The entity assesses and manages risks associated with vendors and business partners. * **Assesses Compliance With Confidentiality Commitments of Vendors and Business Partners** - **Assesses Compliance with Privacy Commitments of Vendors and Business Partners** #### How UpGuard Helps The UpGuard Custom Questionnaire Builder allows organizations to create and send custom questionnaire templates to assess vendors on specific internal and external compliance requirements, including confidentiality and privacy requirements.  Risk and compliance teams can send pre-built questionnaires for relevant data privacy laws, such as the GDPR, PCI DSS, and CCPA, to identify third-party compliance gaps.   [Try UpGuard free for 7 days >](https://www.upguard.com/demo) > P6.4 The entity obtains privacy commitments from vendors and other third parties who have access to personal information to meet the entity’s objectives related to privacy. The entity assesses those parties’ compliance on a periodic and as-needed basis and takes corrective action, if necessary. * **Discloses Personal Information Only to Appropriate Third Parties** #### How UpGuard Helps The UpGuard platform alerts organizations when a vendor’s security score drops below an acceptable level for the organization’s risk appetite. Security teams can prioritize risk remediation based on the severity of identified risks and the vendor’s level of criticality using the Vendor Tiering feature. > P6.4 The entity obtains privacy commitments from vendors and other third parties who have access to personal information to meet the entity’s objectives related to privacy. The entity assesses those parties’ compliance on a periodic and as-needed basis and takes corrective action, if necessary. * **Remediates Misuse of Personal Information by a Third Party** [UpGuard Vendor Risk](https://www.upguard.com/product/vendorrisk) allows security teams to manage and monitor the vendor remediation process through fully automated workflows – from sending remediation requests to recording task completion.  > P6.5 The entity obtains commitments from vendors and other third parties with access to personal information to notify the entity in the event of actual or suspected unauthorized disclosures of personal information. Such notifications are reported to appropriate personnel and acted on in accordance with established incident-response procedures to meet the entity’s objectives related to privacy. [UpGuard Vendor Risk](https://www.upguard.com/product/vendorrisk) allows organizations to manage their vendors centrally within the platform. The UpGuard platform identifies third-party threats and vulnerabilities which could facilitate a data breach, allowing security teams to request remediation immediately. eBook A Complete Guide to Third-Party Risk Management Free resource ### A Complete Guide to Third-Party Risk Management Learn how to protect your business with an effective cybersecurity program. [Download now](/resources/complete-guide-to-third-party-risk-management) ## Related posts Learn more about the latest issues in cybersecurity. Third-Party Risk Management #### [The Evidence Is In: UpGuard Named a Leader in the IDC MarketScape for Worldwide Third-Party Risk Management](/blog/upguard-named-leader-in-idc-marketscape) UpGuard has been named a Leader in the IDC MarketScape: Worldwide Third-Party Risk Management Services 2026 Vendor Assessment. Find out why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) October 18, 2026 Third-Party Risk Management #### [We Researched Four AI Evidence Analysis Tools for TPRM. Here’s What We Found.](/blog/ai-evidence-analysis-tools-for-tprm) We researched four AI evidence-parsing tools against four criteria that security teams often overlook. None nailed all four. [](/team/cassy-van-eeden) [Cassy van Eeden](#) September 29, 2026 Third-Party Risk Management #### [The Vendor Assurance Confidence Gap: Why It’s Widest With Your Most Critical Vendors](/blog/vendor-assurance-confidence-gap) Vendor assurance efforts are rising while confidence in them is falling. This gap is widest with the vendors that matter most. Here’s why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) August 25, 2026 Third-Party Risk Management #### [Higher Education TPRM in 2026: New Research Maps the Vendor Visibility Gap](/blog/higher-education-tprm-2026) Explore UpGuard’s latest research into higher education third-party risk, including supplier concentration and systemic vendor exposure. [](/team/cassy-van-eeden) [Cassy van Eeden](#) August 10, 2026 Third-Party Risk Management #### [Ongoing TPRM Success: Continuous Security Monitoring with AI](/blog/continuous-security-monitoring-with-ai) Is manual work weighing down your security team and limiting your ability to scale? Learn how UpGuard and its AI features can help. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) September 29, 2026 Third-Party Risk Management #### [Report Writing Solved: Generating Actionable Assessment Reports](/blog/report-writing-solved) Is manual report writing slowing down your security team? Learn how UpGuard’s AI can help. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) April 2, 2025 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)