A SOC 2 bridge letter is a short letter from a company's management confirming its controls have not materially changed since its last SOC 2 report ended.
Customers ask for one when your report's audit period ended a few months ago and the next report is not ready yet. The letter "bridges" that gap. It is also called a gap letter.
Reviewed by Riya Ann Varghese, GRC Engineer, ISO 27001 lead auditor. Last updated October 21, 2026.
How We Wrote This Guide
We based this guide on how SOC 2 reports and bridge letters work in practice, published guidance from CPA firms, and public examples such as the bridge letters Google Cloud makes available to its customers. The template and examples come from the SOC 2 audits we support. A GRC engineer reviewed every section.
What Is a SOC 2 Bridge Letter?
A SOC 2 bridge letter is a signed statement from your management that covers the time between the end of your last SOC 2 audit period and today.
A SOC 2 Type 2 report only covers a fixed period, for example April 1, 2025 to March 31, 2026. Nothing after March 31 is covered. If a customer reviews you in June, they have a three-month blind spot. The bridge letter fills it by telling them whether anything important changed.
A bridge letter is not an audit. Your auditor does not test or sign it. It is your company's own word, which is why customers treat it as a short-term fix, not a replacement for the report.
Do SOC 2 Reports Have Bridge Letters?
Yes, SOC 2 reports often come with a bridge letter when a customer's review date falls after the report's audit period ends.
Large cloud providers publish them alongside their reports, and most SaaS companies send one on request. You only need one if a customer or their auditor asks.
SOC 1 vs SOC 2 Bridge Letters
A SOC 1 bridge letter works the same way as a SOC 2 bridge letter, but it covers controls over customers' financial reporting instead of security.
SOC 1 bridge letters are very common because customers' financial auditors need coverage up to the customer's fiscal year-end, usually December 31. SOC 2 bridge letters are more often triggered by vendor security reviews and contract renewals.
When Do You Need a SOC 2 Bridge Letter?
You need a SOC 2 bridge letter when a customer asks for assurance about a period your latest SOC 2 report does not cover.
You may also need one if you are in the observation period of your first SOC 2 Type 2 audit, with your controls already in place, and a customer wants proof before they sign a deal.
| Situation | Example | Bridge letter? |
|---|---|---|
| Your report period ended a few months ago | Report ended March 31, customer reviews you in June | Yes |
| Customer needs coverage to its year-end | Customer's auditor needs assurance to December 31 | Yes |
| Your next audit is running late | Fieldwork slipped by a month | Yes, for the extra time |
| Your report is still current | Period ended last month | Usually not |
| You are in your first observation period | Controls are in place, the Type 2 audit window is running, and a deal needs proof now | Yes, a management letter can help close the deal. Pair it with a SOC 2 Type 1 report or a letter from your auditor confirming the audit is underway |
| You have not started a SOC 2 audit yet | Controls are still being set up | No. Share a readiness letter instead |
| The gap is longer than about 3 months | Report ended 8 months ago | A letter alone is weak. Expect customers to ask for the new report |
What Goes in a SOC 2 Bridge Letter?
A SOC 2 bridge letter states the last report's period, the gap it covers, whether controls changed, and when the next report is due.
| Part | Example wording | Why it matters |
|---|---|---|
| Company letterhead and date | Northwind Analytics, Inc., July 1, 2026 | Shows it comes from management |
| The last report | SOC 2 Type 2 report from Example CPA LLP, April 1, 2025 to March 31, 2026 | Ties the letter to a real audit |
| The gap period | April 1, 2026 to June 30, 2026 | Tells the customer exactly what is covered |
| Changes since the report | "No material changes to the system or controls" | The main thing the customer needs to know |
| Known control failures | "Not aware of any failures that would change the auditor's conclusions" | Covers incidents and exceptions during the gap |
| Next report date | Expected May 2027 | Shows when proper assurance resumes |
| Disclaimer | "Not audited, does not replace our SOC 2 report" | Keeps the letter honest |
| Signature | CISO, CTO, or CEO | Someone accountable stands behind it |
SOC 2 Bridge Letter Template
A SOC 2 bridge letter template is a one-page letter you fill in with your report dates, gap dates, changes, and a signature.
Copy this template and replace the text in brackets. The AICPA does not publish an official template, so check the wording with your auditor before you first use it.
[Company letterhead]
[Date]
Re: SOC 2 Type 2 Bridge Letter
To our customers and their auditors:
[Company name] received a SOC 2 Type 2 report from [CPA firm] covering the period [start date] to [end date], for the [Trust Services Criteria in scope] criteria.
This letter covers the period [day after report end] to [gap end date]. During this period, there have been no material changes to the system or to the controls described in that report, and we are not aware of any control failures that would change the auditor's conclusions. [If something changed, describe it here instead.]
Our next SOC 2 Type 2 report, covering [next period], is expected in [month and year].
This letter is a statement by [Company name] management. It has not been audited and does not replace our SOC 2 report.
Sincerely,
[Name], [Title] [Contact email]
SOC 2 Bridge Letter Example
This SOC 2 bridge letter example fills in the same template for a fictional company, Northwind Analytics.
Who Writes and Signs a SOC 2 Bridge Letter?
Your own management writes and signs a SOC 2 bridge letter, not your auditor.
The auditor cannot sign it because they have not tested the gap period. Their opinion only covers the period in the report. The letter is usually signed by someone who owns security or the business, such as the CISO, CTO, or CEO. Keep a copy of every bridge letter you send, because your next auditor may ask about changes you reported.
The AICPA, which sets SOC 2 standards, does not regulate bridge letters. That is why wording varies from company to company.
How Long Is a SOC 2 Bridge Letter Valid?
A SOC 2 bridge letter usually covers three months or less, which is common practice rather than an official rule.
The longer the gap, the less a customer can rely on management's word alone. Many customers accept a bridge letter for up to three months, question anything longer, and ask for the new report once the gap passes six months. Each bridge letter should end on a specific date. If the gap grows, send a new letter rather than stretching the old one.
Most companies avoid long gaps by renewing their SOC 2 audit every year. Our guide to SOC 2 Type 2 reports explains how the yearly cycle works.
What If Your Controls Changed During the Gap?
If your controls changed during the gap, say so in the bridge letter, describe the change, and explain how the control objective is still met.
Hiding a change is the biggest bridge letter mistake. If your next auditor finds it, the letter becomes a trust problem.
| Change during the gap | Disclose it? | How to describe it |
|---|---|---|
| Moved to a new identity provider | Yes | Name the change and confirm MFA and access reviews still apply |
| Moved hosting to a new cloud region | Yes, if in scope | Confirm the same security controls run in the new region |
| Security incident | Yes, if material | Summarize what happened, how it was handled, and what changed |
| Missed a quarterly access review | Yes | State the gap and when it was completed |
| New employees hired | No | Normal operations, covered by existing controls |
| Routine software updates | No | Covered by your change management control |
A disclosed and fixed issue looks far better than a surprise. Our guide to SOC 2 exceptions explains how auditors treat control failures.
How Customers Review a SOC 2 Bridge Letter
Customers review a SOC 2 bridge letter by checking that it matches the report, covers the right dates, and is signed by someone accountable.
If you review vendors, check these points:
- The report period and auditor in the letter match the actual SOC 2 report.
- The gap starts the day after the report period ended, with no unexplained days.
- The gap is short, ideally three months or less.
- Any changes are described, not just "no material changes" every time.
- A senior person signed it, and the next report date is given.
Our guide to what a SOC 2 report covers explains the parts of the report itself.
Bridge Letter vs SOC 2 Report vs SOC 3
A bridge letter is management's unaudited statement, while SOC 2 and SOC 3 reports are issued by an independent CPA firm.
| Bridge letter | SOC 2 report | SOC 3 report | |
|---|---|---|---|
| Who issues it | Your management | Independent CPA firm | Independent CPA firm |
| Audited? | No | Yes | Yes |
| Length | One page | Often 50 to 100+ pages | A few pages |
| Covers | The gap after the last report | A fixed audit period | The same period as the SOC 2 |
| Shared how | On request, often with the report | Under NDA | Publicly, often in a trust center |
How to Avoid Needing a Bridge Letter
To avoid needing a SOC 2 bridge letter, renew your audit every year and time your audit period around when customers review you.
- Start the next audit period the day after the last one ends, so there is never a gap in coverage.
- Ask your auditor for a realistic report date and plan around it.
- If many customers review you at year-end, end your audit period closer to December.
- Keep evidence collection running all year with a SOC 2 compliance checklist and monitoring, so audits are not delayed.
How UprootSecurity Approaches Compliance
A bridge letter covers a short gap. Keeping your SOC 2 current, so gaps stay short, is the work that matters.
| What you need | How UprootSecurity handles it |
|---|---|
| Know what changed before you sign | Continuous monitoring across 140+ integrations |
| A report on time every year | Evidence collected all year and a dedicated compliance expert to plan your audit |
| Proof for customers | A trust center and security questionnaire automation |
| More than one framework | SOC 2, ISO 27001, HIPAA, and more from one set of controls |
| A clear price | A custom quote based on your scope, with a yearly penetration test in every plan |
UprootSecurity is a compliance platform for startups and scaleups that need SOC 2 and other frameworks. See our SOC 2 framework page and plans.
Frequently Asked Questions
A SOC 2 bridge letter is a short letter from a company's management confirming its controls have not materially changed since its last SOC 2 report ended. It covers the gap between the end of the report's audit period and today. It is not audited, and it does not replace the SOC 2 report itself.
A bridge letter means a written statement that "bridges" the time between the end of an audit report's period and a later date. In SOC reporting, management uses it to tell customers whether anything important changed after the auditor's period ended. It is also called a gap letter.
A SOC 1 bridge letter is a management letter that covers the gap between the end of a SOC 1 report period and a customer's fiscal year-end. Customers' financial auditors often ask for one. It works like a SOC 2 bridge letter but covers controls over financial reporting instead of security.
A SOC 2 bridge letter is signed by the company's own management, usually the CISO, CTO, or CEO. The CPA firm that did the audit does not sign it, because it has not tested the gap period. The signer should be senior enough to be accountable for the statement.
A SOC 2 bridge letter usually covers three months or less after the report period ends. This is common practice, not an official rule. Many customers question longer gaps and ask for the new report once the gap passes about six months. Each letter should state an exact end date.
No, a SOC 2 bridge letter is not required by the AICPA or by law. It is a courtesy document that customers often ask for during vendor reviews. If a customer's contract or auditor needs coverage beyond your report period, sending a bridge letter is the normal and expected response.
No, the AICPA does not publish an official bridge letter template or rules for bridge letters. Because the letter is a management statement, not an audit report, companies write their own. Most follow the same structure: report period, gap period, changes, next report date, disclaimer, and signature.
A bridge letter can cover more than three months, but customers trust it less as the gap grows. Beyond three months, many will ask why the new report is late. Beyond six months, most will want the new report. If your audit is delayed, explain why and give a firm report date.
Yes, if you are in the observation period of your first SOC 2 Type 2 audit and your controls are already in place. The letter states when your controls went live, your audit window dates, and when the report is due. Customers trust it more when you add a SOC 2 Type 1 report or a letter from your auditor.
If something changed during the bridge period, describe it in the bridge letter instead of saying there were no changes. Explain what changed, when, and how the control objective is still met. Customers trust honest disclosures, and your next auditor may compare the letter against what actually happened.
