mediumConceptScenarioMidSeniorStaff
A customer asks how you meet a control your cloud provider handles. What can you claim from their certification?
6 min readUpdated 2026-08-15
Answer
Short answer
You inherit only the part the provider performs, and their report names the controls it assumes you operate yourself. Your evidence is their report plus your record that you checked its scope, period and complementary user entity controls, and then evidence for the configuration that remains yours.
Was this answer helpful?
Likely follow-ups
- The service you depend on is not listed in the provider's report scope. What now?
- Your customer's auditor wants to test the provider's controls directly. What do you offer instead?
- How do you cover the gap between the end of one report period and today?
- Which controls can never be inherited, no matter how the provider is certified?
Related questions
- What is the difference between SOC 2 and ISO 27001, and what does an auditor accept as evidence?mediumAlso on iso-270016 min
- You were audited a year ago and the product has changed a great deal since. A customer asks whether your newest service is covered. What do you tell them?hardAlso on iso-270016 min
- A vendor whose product sits in your critical path has announced end of life in nine months. Walk me through the decision.hardAlso on vendor-risk6 min
- How do you decide whether to build a capability in-house or buy it?mediumAlso on vendor-risk5 min