thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Advanced

Subservice Organization

Vendor used by a service organization whose controls may be relevant to the service organization's customers.

Definition

SOC reports address subservice organizations using either the inclusive method (their controls are included and tested) or the carve-out method (their controls are excluded and listed as complementary subservice organization controls). Customers may need separate reports for carved-out subservice providers.

Example

A SaaS provider's SOC 2 carves out its IaaS host, so customers must review the host's own SOC 2.

Exam tip

Carve-out means you need to obtain assurance about the subservice organization separately.

Related terms